CVE-2026-54776: CoreWCF Auth Bypass Vulnerability

CVE-2026-54776 Overview

CVE-2026-54776 is an authentication bypass vulnerability in CoreWCF, the .NET Core port of the service-side Windows Communication Foundation (WCF). The flaw affects CoreWCF services hosted on Unix Domain Sockets that use PosixIdentity client credentials. A client can establish a connection and dispatch messages without completing the application/unixposix stream upgrade, bypassing the framing-layer identity checks performed by UnixPosixIdentitySecurityUpgradeProvider. The issue is tracked as [CWE-306: Missing Authentication for Critical Function] and is fixed in CoreWCF versions 1.8.1 and 1.9.1.

Critical Impact
Local attackers with access to the Unix Domain Socket can send messages to a CoreWCF service without proving PosixIdentity credentials, undermining identity-based access control at the framing layer.

Affected Products

CoreWCF versions prior to 1.8.1
CoreWCF versions prior to 1.9.1 in the 1.9.x branch
CoreWCF services hosted on Unix Domain Sockets with PosixIdentity client credentials

Discovery Timeline

2026-07-08 - CVE-2026-54776 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54776

Vulnerability Analysis

CoreWCF ports the service side of Windows Communication Foundation to .NET Core, including support for Unix Domain Socket (UDS) transports on Linux and macOS. When a service binding declares PosixIdentity client credentials, the framing layer expects the client to negotiate an application/unixposix stream upgrade before message dispatch. That upgrade is the point at which the server binds a validated peer identity to the connection.

In versions prior to 1.8.1 and 1.9.1, the UnixPosixIdentitySecurityUpgradeAcceptor constructor eagerly instantiates a SecurityMessageProperty before the upgrade handshake occurs. Downstream code treats the presence of that property as evidence that identity negotiation succeeded. A client that skips the stream upgrade and sends framed messages directly is dispatched as if it had authenticated, bypassing the PosixIdentity check.

Root Cause

The root cause is a missing authentication check on a critical code path [CWE-306]. Security state is initialized before the negotiation that would populate it, allowing the acceptor to be reused in a partially initialized configuration. The fix defers creation of _remoteSecurity until the application/unixposix upgrade has actually been processed.

Attack Vector

Exploitation requires local access to the Unix Domain Socket endpoint that the CoreWCF service listens on. An attacker with permission to open the socket connects and sends framed WCF messages without performing the application/unixposix stream upgrade. The server dispatches those messages under a pre-populated SecurityMessageProperty instead of rejecting the unauthenticated peer.

text

// Patch: src/CoreWCF.UnixDomainSocket/src/CoreWCF/Channels/UnixPosixIdentitySecurityUpgradeProvider.cs
 public UnixPosixIdentitySecurityUpgradeAcceptor(UnixPosixIdentitySecurityUpgradeProvider parent)
 {
     _parent = parent;
-    _remoteSecurity = new SecurityMessageProperty();
     _upgradeString = "application/unixposix";
 }

// Source: https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3

The patch removes the eager initialization of _remoteSecurity, forcing the value to be populated only after the PosixIdentity stream upgrade completes successfully.

Detection Methods for CVE-2026-54776

Indicators of Compromise

CoreWCF service logs showing dispatched messages on UDS endpoints without a preceding application/unixposix upgrade record.
Unexpected local processes connecting to CoreWCF Unix Domain Socket paths outside of documented client inventories.
Application-layer audit entries where the resolved peer identity is empty, default, or inconsistent with the connecting process UID.

Detection Strategies

Inventory .NET services that reference the CoreWCF.UnixDomainSocket package at versions below 1.8.1 or between 1.9.0 and 1.9.0 inclusive.
Enable verbose CoreWCF tracing on affected services and alert when messages are dispatched without a matching stream upgrade negotiation event.
Compare the effective peer UID reported by the OS on the UDS with the identity CoreWCF associates with the dispatched message.

Monitoring Recommendations

Monitor filesystem permissions on Unix Domain Socket paths and alert on changes that widen access beyond intended service principals.
Track process-level connections to CoreWCF UDS endpoints using auditd or eBPF-based telemetry to establish a baseline of expected clients.
Review dependency manifests (.csproj, packages.lock.json) in CI pipelines and fail builds that pull vulnerable CoreWCF versions.

How to Mitigate CVE-2026-54776

Immediate Actions Required

Upgrade CoreWCF to 1.8.1 on the 1.8.x branch or 1.9.1 on the 1.9.x branch as documented in the CoreWCF Release v1.8.1 and CoreWCF Release v1.9.1 notes.
Restrict filesystem permissions on Unix Domain Socket paths so that only trusted local principals can connect.
Audit service bindings that declare PosixIdentity client credentials and confirm they are hosted on patched runtimes before returning to production.

Patch Information

The upstream fix is described in GitHub Security Advisory GHSA-wjpq-6766-7f5j and implemented across three commits: 994431268e3362c0cd126450fe2a135c202551f3, 9af16955e51a57348dafce0019e259a092ef7440, and f2f1a05927a88b8a75fa0582fa8ed75eb891e463. Each patch defers SecurityMessageProperty creation in the PosixIdentity stream upgrade acceptor until after the upgrade completes.

Workarounds

If patching is not immediately possible, disable Unix Domain Socket bindings that rely on PosixIdentity client credentials and route traffic through an alternative authenticated transport.
Constrain socket file mode and directory ownership so that only the intended client UID can open the endpoint, reducing the local attack surface until the upgrade is deployed.

bash

# Restrict a CoreWCF Unix Domain Socket to a specific client UID
chown coreWcfSvc:trustedClient /var/run/corewcf/service.sock
chmod 660 /var/run/corewcf/service.sock

# Update the CoreWCF package reference to a fixed version
dotnet add package CoreWCF.UnixDomainSocket --version 1.9.1