{"id":"CVE-2026-54776","title":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","summary":"CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade","severity":"medium","cvss":4.4,"cwe":["CWE-306"],"vendor":"CoreWCF","product":"CoreWCF.UnixDomainSocket","ecosystem":"nuget","affected":["CoreWCF.UnixDomainSocket < 1.8.1","CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1"],"patched":["CoreWCF.UnixDomainSocket 1.8.1","CoreWCF.UnixDomainSocket 1.9.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wjpq-6766-7f5j","references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j"},{"url":"https://github.com/advisories/GHSA-wjpq-6766-7f5j"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T13:35:24.434Z","epss":0.00152,"epssPercentile":0.04718,"slug":"CVE-2026-54776","body":"## Overview\n\n### Impact\nA CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and Security.Transport.ClientCredentialType = PosixIdentity) does not require the client to perform the application/unixposix stream upgrade before dispatching messages.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict filesystem access to the UDS socket file using owner/group/mode (e.g. chmod 0660 plus a dedicated group) so that only the POSIX users who are already authorized to invoke the service can connect at all. This makes the missing-upgrade behaviour equivalent to the operating system’s filesystem permissions instead of relying on framing-layer identity checks.\nAvoid relying on ServiceSecurityContext.PrimaryIdentity for authorization decisions, or back it up with an authentication-required authorization policy that rejects anonymous principals.\n\n## Affected packages\n\n- `CoreWCF.UnixDomainSocket < 1.8.1`\n- `CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `CoreWCF.UnixDomainSocket 1.8.1`\n- `CoreWCF.UnixDomainSocket 1.9.1`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}