Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M

CVE-2026-30968Coral Server has insufficient validation of agent identity for SSE connections

High 8.6

In plain English

A high-severity missing authorization in coral-server from Coral-Protocol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the SSE endpoint (/sse/v1/...) in Coral Server did not strongly validate that a connecting agent was a legitimate participant in the session. This could theoretically allow unauthorized message injection or observation. This vulnerability is fixed in 1.1.0.

Affected products (as reported)

Vendor	Product	Versions
Coral-Protocol	coral-server	< 1.1.0

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-2rj5-3pgm-xqw9 x_refsource_CONFIRM
https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0 x_refsource_MISC