CVE-2026-30969 is a critical flaw (CVSS 9.1) in Coral Server before 1.1.0. Authentication between agents and the server inside a session was not strong, so someone who got or guessed a session identifier could impersonate an agent. Upgrade to 1.1.0.
What's affected
Coral Server versions before 1.1.0 are affected. The fix is in 1.1.0. The problem concerns authentication between agents and the server inside an active session.
How to check if you're exposed
Find the version of Coral Server you run, from the release tag, the container image tag or your build record, and compare it with 1.1.0.
Check whether the server and its session endpoints are reachable from outside the network where your agents run.
What to do now
- Upgrade Coral Server to 1.1.0 or later.
- Keep the server on a private network until the upgrade is done.
- Treat existing session identifiers as compromised if they may have been seen by others, and start fresh sessions after upgrading.
Why it matters
The weakness class is CWE-639, authorization bypass through user controlled key. A session identifier acted as the main key. The record says an attacker who obtained or predicted one could impersonate an agent or join an existing session, because the server did not enforce strong authentication on top of it.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. Read the advisory for the exact scope.
Quick check
Is an upgrade the only fix?
The record lists 1.1.0 as the fix. Network restrictions can lower exposure while you plan the upgrade.
Sources
Last reviewed: 19 October 2026.
