Vulnerability Description
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Coralos | Coral Server | < 1.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0Release Notes
- https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqPatchVendor Advisory
FAQ
What is CVE-2026-30970?
CVE-2026-30970 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent se...
How severe is CVE-2026-30970?
CVE-2026-30970 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-30970?
Check the references section above for vendor advisories and patch information. Affected products include: Coralos Coral Server.