CVE-2026-30968 is a critical missing authorization flaw (CVSS 9.8) in the SSE endpoint of Coral Server before 1.1.0. The server did not strongly check that a connecting agent belonged to the session. Upgrade to Coral Server 1.1.0.
What's affected
Coral Server versions before 1.1.0 are affected. The fix is in 1.1.0. The affected area is the SSE endpoint under /sse/v1/.
How to check if you're exposed
Find the version of Coral Server you run, from the release tag, the container image tag or your build record, and compare it with 1.1.0.
Check whether the server and its session endpoints are reachable from outside the network where your agents run.
What to do now
- Upgrade Coral Server to 1.1.0 or later.
- Keep the server on a private network until the upgrade is done.
- Treat existing session identifiers as compromised if they may have been seen by others, and start fresh sessions after upgrading.
Why it matters
The weakness class is CWE-862, missing authorization. The server did not strongly validate that the agent connecting to a session was a real participant, which the record says could allow unauthorized message injection or observation. The record uses the word theoretically, so the advisory should be read for how practical it is.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. Read the advisory for the exact scope.
Quick check
Is an upgrade the only fix?
The record lists 1.1.0 as the fix. Network restrictions can lower exposure while you plan the upgrade.
Sources
Last reviewed: 19 October 2026.
