CVE-2026-30969

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30969", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:53:48.815Z", "datePublished": "2026-03-10T17:27:24.956Z", "dateUpdated": "2026-03-10T20:39:42.639Z"}, "containers": {"cna": {"title": "Coral Server has insufficient agent authentication in session communication channels", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-ccx7-7wv9-c55x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-ccx7-7wv9-c55x"}, {"name": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0"}], "affected": [{"vendor": "Coral-Protocol", "product": "coral-server", "versions": [{"version": "< 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T17:27:24.956Z"}, "descriptions": [{"lang": "en", "value": "Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce strong authentication between agents and the server within an active session. This could allow an attacker who obtained or predicted a session identifier to impersonate an agent or join an existing session. This vulnerability is fixed in 1.1.0."}], "source": {"advisory": "GHSA-ccx7-7wv9-c55x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T20:39:28.836916Z", "id": "CVE-2026-30969", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:39:42.639Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T20:39:28.836916Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:39:37.167Z"}}], "cna": {"title": "Coral Server has insufficient agent authentication in session communication channels", "source": {"advisory": "GHSA-ccx7-7wv9-c55x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Coral-Protocol", "product": "coral-server", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "references": [{"url": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-ccx7-7wv9-c55x", "name": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-ccx7-7wv9-c55x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0", "name": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce strong authentication between agents and the server within an active session. This could allow an attacker who obtained or predicted a session identifier to impersonate an agent or join an existing session. This vulnerability is fixed in 1.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T17:27:24.956Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30969", "state": "PUBLISHED", "dateUpdated": "2026-03-10T20:39:42.639Z", "dateReserved": "2026-03-07T17:53:48.815Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T17:27:24.956Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coral-server", "vendor": "Coral-Protocol", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:coralos:coral_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "08D51A1E-4EA2-4413-936B-36CBB428C2FC", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce strong authentication between agents and the server within an active session. This could allow an attacker who obtained or predicted a session identifier to impersonate an agent or join an existing session. This vulnerability is fixed in 1.1.0."}, {"lang": "es", "value": "Coral Server es infraestructura de colaboraci\u00f3n abierta que permite comunicaci\u00f3n, coordinaci\u00f3n, confianza y pagos para El Internet de Agentes. Antes de la versi\u00f3n 1.1.0, Coral Server no aplicaba una autenticaci\u00f3n fuerte entre los agentes y el servidor dentro de una sesi\u00f3n activa. Esto podr\u00eda permitir a un atacante que obtuviera o predijera un identificador de sesi\u00f3n suplantar a un agente o unirse a una sesi\u00f3n existente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.1.0."}], "id": "CVE-2026-30969", "lastModified": "2026-06-17T10:33:14.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30969", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T20:39:28.836916Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:55.760", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-ccx7-7wv9-c55x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "coral-server", "source": "cna", "vendor": "Coral-Protocol"}, "product": "coral-server", "vendor": "coral-protocol"}], "analysis": {"en": {"generated_at": "2026-04-16T03:47:24.076236+00:00", "value": {"mitigation_remediation": ["Update Coral Server to version 1.1.0 or later to apply the fix.", "Enforce the use of secure transport (TLS/SSL) and session identifiers that are unpredictable and transmitted only over encrypted channels.", "Verify that all existing Coral Server deployments have been upgraded and conduct a post-mitigation assessment to confirm no legacy versions remain in operation."], "summary": {"action": "Patch", "impact": "Unauthorized agent impersonation within active sessions"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all Coral-Protocol Coral Server installations using versions earlier than 1.1.0. Current releases from version 1.1.0 onward include the fix.", "description_and_impact": "Coral Server failed to enforce strong authentication between agents and the server during an active session, allowing an attacker who can obtain or predict a session identifier to impersonate an agent or join an existing session. This results in the attacker gaining unauthorized access to collaboration channels, potentially compromising the integrity, confidentiality, and availability of the communication, coordination, trust, and payment functions. The weakness involves authorization bypass through user-controlled keys.", "risk_and_exploitability": "The CVSS score of 7.6 indicates a high impact, while the EPSS score of less than 1% suggests a very low likelihood of exploitation as of this analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to obtain a valid session identifier\u2014potentially through network sniffing, phishing, or other means\u2014to impersonate an agent, implying that the attack vector is remote and contingent on session ID exposure."}}}}, "created": "2026-03-11T11:44:52.805405+00:00", "updated": "2026-04-16T04:00:09.435416+00:00", "vendors": ["coral-protocol", "coral-protocol$PRODUCT$coral-server"]}