{"id":"CVE-2026-54776","aliases":["GHSA-wjpq-6766-7f5j"],"url":"https://o3.security/vulnerability/CVE-2026-54776","summary":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","details":"### Impact\nA CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and Security.Transport.ClientCredentialType = PosixIdentity) does not require the client to perform the application/unixposix stream upgrade before dispatching messages.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict filesystem access to the UDS socket file using owner/group/mode (e.g. chmod 0660 plus a dedicated group) so that only the POSIX users who are already authorized to invoke the service can connect at all. This makes the missing-upgrade behaviour equivalent to the operating system’s filesystem permissions instead of relying on framing-layer identity checks.\nAvoid relying on ServiceSecurityContext.PrimaryIdentity for authorization decisions, or back it up with an authentication-required authorization policy that rejects anonymous principals.","published":"2026-07-08T22:04:39.200Z","modified":"2026-10-21T02:58:35.627231809Z","cvss":{"score":4.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"score":0.00152,"percentile":0.04644,"asOf":"2026-09-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"CoreWCF.UnixDomainSocket","fixedVersion":"1.8.1"},{"ecosystem":"NuGet","name":"CoreWCF.UnixDomainSocket","fixedVersion":"1.9.1"}],"fix":{"url":"https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3","label":"CoreWCF/CoreWCF@9944312"},"references":[{"type":"WEB","url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1"},{"type":"WEB","url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54776.json"},{"type":"ADVISORY","url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54776"},{"type":"FIX","url":"https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3"},{"type":"FIX","url":"https://github.com/CoreWCF/CoreWCF/commit/9af16955e51a57348dafce0019e259a092ef7440"},{"type":"FIX","url":"https://github.com/CoreWCF/CoreWCF/commit/f2f1a05927a88b8a75fa0582fa8ed75eb891e463"},{"type":"PACKAGE","url":"https://github.com/CoreWCF/CoreWCF"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:35.627231809Z"}}