CVE-2026-30970

Katalog CVE

CVSS 9.1 · Critical EPSS 0,60%

Kerentanan Missing Authorization pada coralos coral server. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp patch · advisory vendor
• https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0 release notes