Unrated severityNVD Advisory· Published Mar 10, 2026· Updated Mar 12, 2026
Session authentication bypass in Coral Server session creation endpoint
CVE-2026-30970
Description
Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0.
Affected products
2<1.1.0+ 1 more
- (no CPE)range: <1.1.0
- (no CPE)range: < 1.1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0mitrex_refsource_MISC
- github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgpmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.