GCVE - cpe:2.3:a:coralos:coral_server:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:coralos:coral_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Coralos (`93a6d886-f5e6-574d-a30e-fe23c7f88b51`)
Product	Coral Server (`2829b142-4c67-53fe-8274-e13eecef420d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
`pkg:github/coral-protocol/coral-server`	purl2cpe	2026-07-28 16:40:59.053235

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-30970`	vulnerable	2026-06-08 07:57:14.635956	Session authentication bypass in Coral Server session creation endpoint Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint performs resource-intensive initialization operations including container spawning and memory context creation. An attacker capable of accessing the endpoint could create sessions or consume system resources without proper authorization. This vulnerability is fixed in 1.1.0. Published: 2026-03-10T17:30:00.988Z Updated: 2026-03-12T14:26:11.332Z Open on db.gcve.eu Reference links https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-wqfm-hhqf-9hgp https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30969`	vulnerable	2026-06-08 07:57:14.635549	Coral Server has insufficient agent authentication in session communication channels Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server did not enforce strong authentication between agents and the server within an active session. This could allow an attacker who obtained or predicted a session identifier to impersonate an agent or join an existing session. This vulnerability is fixed in 1.1.0. Published: 2026-03-10T17:27:24.956Z Updated: 2026-03-10T20:39:42.639Z Open on db.gcve.eu Reference links https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-ccx7-7wv9-c55x https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30968`	vulnerable	2026-06-08 07:57:14.635099	Coral Server has insufficient validation of agent identity for SSE connections Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the SSE endpoint (/sse/v1/...) in Coral Server did not strongly validate that a connecting agent was a legitimate participant in the session. This could theoretically allow unauthorized message injection or observation. This vulnerability is fixed in 1.1.0. Published: 2026-03-10T17:24:11.604Z Updated: 2026-03-10T17:40:58.576Z Open on db.gcve.eu Reference links https://github.com/Coral-Protocol/coral-server/security/advisories/GHSA-2rj5-3pgm-xqw9 https://github.com/Coral-Protocol/coral-server/releases/tag/v1.1.0	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.