Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-30968: Coral Server lets unauthorized agents join SSE stream

CVE-2026-30968 · published 7 months ago

Summary

The Coral Server version before 1.1.0 does not properly check that an agent connecting to its server‑sent events (SSE) endpoint is allowed to participate. This could let outsiders watch or inject messages into ongoing sessions. Update to version 1.1.0 or later to enforce proper identity checks.

What to do

Update coralos coral_server to version 1.1.0 or later.

Affected software

Vendor	Product	Affected versions
coralos	coral_server	< 1.1.0 `cpe:2.3:a:coralos:coral_server::::::::`

Original advisory text

Coral Server has insufficient validation of agent identity for SSE connections

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the SSE endpoint (/sse/v1/...) in Coral Server did not strongly validate that a connecting agent was a legitimate participant in the session. This could theoretically allow unauthorized message injection or observation. This vulnerability is fixed in 1.1.0.

References

https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30968... Vendor Advisory
https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-2rj5-3pg... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-30968 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published10 Mar 2026

Updated4 Nov 2026

First seen11 Mar 2026

Sources

CVE-2026-30968 · NVD

CVE-2026-30968 · OSV

GHSA-2rj5-3pgm-xqw9 · GHSA

Track software like this

Free during beta