CVE-2026-30969CWE-639

Coral Server has insufficient agent authentication in session communication channels

High · published March 10, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce strong authentication between agents and the server within an active session. This could allow an attacker who obtained or predicted a session identifier to impersonate an agent or join an existing session. This vulnerability is fixed in 1.1.0.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-10T17:27Z
EPSS history
Timeline
  • 10 MAR 17:27Z
    Coral Server has insufficient agent authentication in session communication channels
    cvelistv5