{"id":"CVE-2026-54776","aliases":["EUVD-2026-42461","GHSA-wjpq-6766-7f5j"],"status":"published","title":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00152,"percentile":0.04397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2026-06-19T20:46:52Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"NuGet","package":"CoreWCF.UnixDomainSocket","fixed_in":["1.8.1","1.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"CoreWCF.UnixDomainSocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"CoreWCF.UnixDomainSocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"CoreWCF.UnixDomainSocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1"}]}],"versions":["1.5.0","1.5.0-preview1","1.5.1","1.5.2","1.6.0","1.7.0","1.8.0"]},{"source":"osv","ecosystem":"NuGet","package":"CoreWCF.UnixDomainSocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.1"}]}],"versions":["1.9.0"]}],"products":[{"vendor":"corewcf","product":"corewcf"}],"references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/9af16955e51a57348dafce0019e259a092ef7440","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/f2f1a05927a88b8a75fa0582fa8ed75eb891e463","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-wjpq-6766-7f5j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54776.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54776","tags":["advisory"]},{"url":"https://github.com/CoreWCF/CoreWCF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54776","title":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T22:04:39.2Z","modified":"2026-07-09T12:56:16.584Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-42461","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T22:04:39Z","modified":"2026-07-09T12:56:16Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:04.523855Z"}],"ghsa":[{"id":"GHSA-wjpq-6766-7f5j","title":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","description":"### Impact\nA CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and Security.Transport.ClientCredentialType = PosixIdentity) does not require the client to perform the application/unixposix stream upgrade before dispatching messages.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict filesystem access to the UDS socket file using owner/group/mode (e.g. chmod 0660 plus a dedicated group) so that only the POSIX users who are already authorized to invoke the service can connect at all. This makes the missing-upgrade behaviour equivalent to the operating system’s filesystem permissions instead of relying on framing-layer identity checks.\nAvoid relying on ServiceSecurityContext.PrimaryIdentity for authorization decisions, or back it up with an authentication-required authorization policy that rejects anonymous principals.","status":"published","published":"2026-06-19T20:46:52Z","modified":"2026-06-19T20:46:53Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-54776","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T23:16:55.36Z","modified":"2026-07-09T16:29:14.203Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-54776","title":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T22:04:39.2Z","modified":"2026-10-28T02:30:36.05027974Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-wjpq-6766-7f5j","title":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","description":"### Impact\nA CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and Security.Transport.ClientCredentialType = PosixIdentity) does not require the client to perform the application/unixposix stream upgrade before dispatching messages.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict filesystem access to the UDS socket file using owner/group/mode (e.g. chmod 0660 plus a dedicated group) so that only the POSIX users who are already authorized to invoke the service can connect at all. This makes the missing-upgrade behaviour equivalent to the operating system’s filesystem permissions instead of relying on framing-layer identity checks.\nAvoid relying on ServiceSecurityContext.PrimaryIdentity for authorization decisions, or back it up with an authentication-required authorization policy that rejects anonymous principals.","status":"published","published":"2026-06-19T20:46:52Z","modified":"2026-06-19T21:11:29.955022Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}