CVE-2026-30970 is a critical missing authorization flaw (CVSS 9.1) in Coral Server before 1.1.0. The sessions endpoint could be used without strong authentication to start resource heavy work. Upgrade to Coral Server 1.1.0.
What's affected
Coral Server versions before 1.1.0 are affected. The fix is in 1.1.0. The affected area is the /api/v1/sessions endpoint.
How to check if you're exposed
Find the version of Coral Server you run, from the release tag, the container image tag or your build record, and compare it with 1.1.0.
Check whether the server and its session endpoints are reachable from outside the network where your agents run.
What to do now
- Upgrade Coral Server to 1.1.0 or later.
- Keep the server on a private network until the upgrade is done.
- Treat existing session identifiers as compromised if they may have been seen by others, and start fresh sessions after upgrading.
Why it matters
The weakness class is CWE-862, missing authorization. That endpoint runs costly setup, including spawning containers and creating memory context. The record says anyone who could reach it could create sessions or consume system resources without proper authorization.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. Read the advisory for the exact scope.
Quick check
Is an upgrade the only fix?
The record lists 1.1.0 as the fix. Network restrictions can lower exposure while you plan the upgrade.
Sources
Last reviewed: 19 October 2026.
