PT-2026-24341 · Unknown · Coral-Server

Highseafraf · Publicado 2026-03-10 · Atualizado 2026-03-16 · CVE-2026-30970

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coral Server versions prior to 1.1.0

Description Coral Server is an open collaboration infrastructure designed for communication, coordination, trust, and payments within The Internet of Agents. Before version 1.1.0, the software permitted the creation of agent sessions via the /api/v1/sessions endpoint without robust authentication. This endpoint executes resource-intensive initialization processes, including container spawning and memory context creation. An attacker gaining access to this endpoint could create sessions or exhaust system resources without authorization.

Recommendations Update to version 1.1.0 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-30970

GHSA-WQFM-HHQF-9HGP

Produtos afetados

Coral-Server

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30970.json · Exploit
• https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0 · Nota
• https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033361102499688805 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30970 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30970 · Nota de Segurança