CVE-2026-30970

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30970", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:53:48.815Z", "datePublished": "2026-03-10T17:30:00.988Z", "dateUpdated": "2026-03-12T14:26:11.332Z"}, "containers": {"cna": {"title": "Session authentication bypass in Coral Server session creation endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp"}, {"name": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0"}], "affected": [{"vendor": "Coral-Protocol", "product": "coral-server", "versions": [{"version": "< 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T17:30:00.988Z"}, "descriptions": [{"lang": "en", "value": "Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0."}], "source": {"advisory": "GHSA-wqfm-hhqf-9hgp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:26:02.917526Z", "id": "CVE-2026-30970", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:26:11.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30970", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T14:26:02.917526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:26:07.363Z"}}], "cna": {"title": "Session authentication bypass in Coral Server session creation endpoint", "source": {"advisory": "GHSA-wqfm-hhqf-9hgp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "Coral-Protocol", "product": "coral-server", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "references": [{"url": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp", "name": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0", "name": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T17:30:00.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30970", "state": "PUBLISHED", "dateUpdated": "2026-03-12T14:26:11.332Z", "dateReserved": "2026-03-07T17:53:48.815Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T17:30:00.988Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coral-server", "vendor": "Coral-Protocol", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:coralos:coral_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "08D51A1E-4EA2-4413-936B-36CBB428C2FC", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0."}, {"lang": "es", "value": "Coral Server es una infraestructura de colaboraci\u00f3n abierta que permite la comunicaci\u00f3n, coordinaci\u00f3n, confianza y pagos para la Internet de los Agentes. Antes de 1.1.0, Coral Server permit\u00eda la creaci\u00f3n de sesiones de agente a trav\u00e9s del endpoint /api/v1/sessions sin una autenticaci\u00f3n fuerte. Este endpoint realiza operaciones de inicializaci\u00f3n que consumen muchos recursos, incluyendo la generaci\u00f3n de contenedores y la creaci\u00f3n de contextos de memoria. Un atacante capaz de acceder al endpoint podr\u00eda crear sesiones o consumir recursos del sistema sin la autorizaci\u00f3n adecuada. Esta vulnerabilidad est\u00e1 corregida en 1.1.0."}], "id": "CVE-2026-30970", "lastModified": "2026-06-17T10:33:14.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30970", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:26:02.917526Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:55.913", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "coral-server", "source": "cna", "vendor": "Coral-Protocol"}, "product": "coral-server", "vendor": "coral-protocol"}], "analysis": {"en": {"generated_at": "2026-04-16T03:46:54.811393+00:00", "value": {"mitigation_remediation": ["Upgrade to Coral Server 1.1.0 or newer immediately.", "Until the upgrade can be performed, block or restrict access to the /api/v1/sessions endpoint using firewalls, reverse\u2011proxy authentication, or network segmentation.", "Implement rate limiting or quotas on the session creation endpoint to mitigate resource consumption abuse."], "summary": {"action": "Patch", "impact": "Unauthorized session creation and resource exhaustion"}, "threat_synthesis": {"affected_systems": "The vendor Coral\u2011Protocol\u2019s Coral Server product is affected. All releases before version 1.1.0 are vulnerable; the issue is fixed in 1.1.0 and later.", "description_and_impact": "Coral Server allowed creation of agent sessions through the /api/v1/sessions endpoint without requiring authentication, letting an attacker initiate resource\u2011intensive initialization operations such as container spawning and memory context creation. This bypass enables the attacker to create sessions or exhaust system resources, effectively facilitating denial\u2011of\u2011service or unauthorized usage. The weakness corresponds to Improper Authorization.", "risk_and_exploitability": "The vulnerability has a CVSS score of 8.8 and an EPSS score of less than 1\u202f%, indicating a high severity but currently low exploitation probability. Because the endpoint accepts requests without authentication, the attack vector is likely remote network access to the server\u2019s API. Although not listed in the CISA KEV catalog, the omission does not reduce the risk; operators should treat the flaw as a serious threat to resource availability."}}}}, "created": "2026-03-11T11:44:48.651075+00:00", "updated": "2026-04-16T04:00:09.425348+00:00", "vendors": ["coral-protocol", "coral-protocol$PRODUCT$coral-server"]}