CVE-2026-54778: CoreWCF Race Condition Vulnerability

CVE-2026-54778 Overview

CVE-2026-54778 is a race condition vulnerability in CoreWCF, the .NET Core port of the service side of Windows Communication Foundation (WCF). The flaw resides in the UnixDomainSocket POSIX peer identity resolution logic, which invokes the non-reentrant getpwuid and getgrgid C library functions without synchronization. Concurrent client connections can cause one connection's identity to be attributed to another, breaking authorization guarantees, or crash the host service process under contention. The issue is tracked as [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization). CoreWCF releases 1.8.1 and 1.9.1 remediate the vulnerability.

Critical Impact
Concurrent Unix domain socket connections can cross-attribute peer identities, enabling authorization confusion, or crash the CoreWCF host process, resulting in denial of service.

Affected Products

CoreWCF versions prior to 1.8.1 (1.8.x branch)
CoreWCF versions prior to 1.9.1 (1.9.x branch)
CoreWCF services exposing UnixDomainSocket transport on POSIX hosts

Discovery Timeline

2026-07-08 - CVE-2026-54778 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-54778

Vulnerability Analysis

CoreWCF's UnixDomainSocket transport resolves the peer's POSIX identity by translating the connecting process's UID and GID into user and group names. The resolution path calls getpwuid(3) and getgrgid(3), both of which return pointers to static storage that is shared across all threads in the process. When multiple client connections arrive concurrently, one thread can overwrite the static buffer that another thread is still reading. The result is either a corrupted or swapped identity assigned to a session, or a process crash when internal state becomes inconsistent. Downstream authorization decisions in the service can therefore act on the wrong caller identity, undermining access control on Unix domain socket endpoints.

Root Cause

The root cause is the use of non-reentrant POSIX library functions in a multi-threaded server context without external locking. getpwuid and getgrgid are documented as non-reentrant; the reentrant variants getpwuid_r and getgrgid_r are required for concurrent use. CoreWCF invoked the non-reentrant forms during connection acceptance, producing a classic time-of-check-related race between concurrent identity lookups.

Attack Vector

Exploitation requires local access to the Unix domain socket exposed by the CoreWCF service, since Unix domain sockets are not reachable over the network. A local attacker who can open connections to the socket alongside legitimate users can induce contention on the identity resolution path. Under sufficient concurrency, the attacker can cause identity cross-attribution — potentially having their session evaluated with another user's credentials — or terminate the service process. The attack complexity is elevated because it depends on winning a timing window between concurrent getpwuid/getgrgid invocations.

No public proof-of-concept exploit is available at the time of publication. Technical details are documented in the GitHub Security Advisory GHSA-q6v9-43v5-jv9q and the associated fix commits.

Detection Methods for CVE-2026-54778

Indicators of Compromise

Unexpected CoreWCF host process crashes or restarts on Linux systems using UnixDomainSocket transport, particularly under connection bursts.
Audit log entries showing operations performed under a user identity that does not match the actual connecting process on the socket.
Sudden spikes in concurrent client connections to a CoreWCF Unix domain socket endpoint from local low-privileged accounts.

Detection Strategies

Inventory .NET services on Linux hosts and identify any that reference CoreWCF packages at versions below 1.8.1 or 1.9.1.
Correlate application-level identity claims with kernel-provided peer credentials (SO_PEERCRED) captured at the socket layer to detect mismatches.
Alert on repeated abnormal terminations of CoreWCF worker processes tied to UnixDomainSocket bindings.

Monitoring Recommendations

Enable structured logging of resolved peer identities in CoreWCF services and forward logs to a centralized analytics platform for anomaly review.
Monitor local connection rates to Unix domain socket endpoints and flag concurrency patterns that deviate from baseline.
Track patch state of the CoreWCF.UnixDomainSocket NuGet package across build pipelines and production hosts.

How to Mitigate CVE-2026-54778

Immediate Actions Required

Upgrade CoreWCF to version 1.8.1 (for 1.8.x deployments) or 1.9.1 (for 1.9.x deployments) as soon as possible.
Restrict filesystem permissions on the Unix domain socket path so that only trusted local principals can connect.
Review authorization logic that relies on peer identity resolved by CoreWCF and validate against kernel-provided credentials where feasible.

Patch Information

The maintainers released fixes in CoreWCF Release v1.8.1 and CoreWCF Release v1.9.1. The corrective changes are captured in the CoreWCF fix commit, the CoreWCF update commit, and the CoreWCF enhancement commit. The patches replace non-reentrant identity lookups with thread-safe equivalents and add synchronization around POSIX identity resolution.

Workarounds

Disable the UnixDomainSocket transport on affected CoreWCF services until upgrade is possible, using an alternative transport with independent authentication.
Constrain access to the socket file via directory ownership and mode bits (for example, chmod 0600 with a dedicated service account) to reduce the pool of principals able to trigger the race.
Serialize incoming connections at the application layer where feasible to reduce concurrency on the vulnerable code path.

bash

# Update CoreWCF UnixDomainSocket package to a fixed version
dotnet add package CoreWCF.UnixDomainSocket --version 1.9.1

# Verify installed version
dotnet list package | grep CoreWCF

# Restrict access to the Unix domain socket file
chown svc-corewcf:svc-corewcf /var/run/corewcf/service.sock
chmod 0600 /var/run/corewcf/service.sock