Junglewise Threat Intelligence

CVE-2026-54776: CoreWCF auth bypass in Unix Domain Socket PosixIdentity transport

CVE-2026-54776 · Severity: medium · CVSS 4.4 · Published 2026-07-08

Vendors: CoreWCF.

Executive brief

CoreWCF is a tool used to build communication services in modern .NET environments. A security flaw in its Unix Domain Socket transport allows local users to connect to a service while bypassing identity checks. This could allow an unauthorized local user to interact with the service as if they were authenticated, potentially leading to unauthorized data access or manipulation.

Technical details

A vulnerability exists in CoreWCF's Unix Domain Socket transport when using PosixIdentity client credentials. The UnixPosixIdentitySecurityUpgradeAcceptor eagerly initializes its remote security property to an empty value rather than keeping it null until an upgrade occurs. Because the framing pipeline relies on a null sentinel to detect skipped stream upgrades, an attacker can skip the 'application/unixposix' stream upgrade entirely. This bypasses the identity checks performed by UnixPosixIdentitySecurityUpgradeProvider, allowing messages to be dispatched without proper framing-layer identity verification. The issue is fixed in versions 1.8.1 and 1.9.1 by deferring the security property initialization.

Affected products

  • CoreWCF CoreWCF.UnixDomainSocket < 1.8.1, >= 1.9.0 < 1.9.1

Timeline

  • 2026-06-16: patched: Fixes released in versions 1.8.1 and 1.9.1
  • 2026-06-16: advisory: GitHub Security Advisory GHSA-wjpq-6766-7f5j published
  • 2026-07-08: disclosed: CVE-2026-54776 published to NVD

References