CVE-2026-30970 Session authentication bypass in Coral Server session creation endpoint
Attackers can bypass authentication to create agent sessions, leading to unauthorized access and resource exhaustion via container spawning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30970?
CVE-2026-30970 is a high-severity missing authorization vulnerability in Coral-Protocol coral-server, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-30970?
It affects 1 product.
Products include Coralos Coral Server.
How do I fix CVE-2026-30970?
No fix has been published for CVE-2026-30970 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30970 being exploited?
There is no known exploitation of CVE-2026-30970 in the wild and no public exploit code.
Other vulnerabilities in Coral-Protocol coral-server
Sources
Also known as GHSA-wqfm-hhqf-9hgp.