Coral Server allowed creation of agent sessions through the /api/v1/sessions endpoint without requiring authentication, letting an attacker initiate resource‑intensive initialization operations such as container spawning and memory context creation. This bypass enables the attacker to create sessions or exhaust system resources, effectively facilitating denial‑of‑service or unauthorized usage. The weakness corresponds to Improper Authorization.

The vendor Coral‑Protocol’s Coral Server product is affected. All releases before version 1.1.0 are vulnerable; the issue is fixed in 1.1.0 and later.

The vulnerability has a CVSS score of 8.8 and an EPSS score of less than 1 %, indicating a high severity but currently low exploitation probability. Because the endpoint accepts requests without authentication, the attack vector is likely remote network access to the server’s API. Although not listed in the CISA KEV catalog, the omission does not reduce the risk; operators should treat the flaw as a serious threat to resource availability.