---
id: CVE-2026-54776
title: >-
  CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that
  skip the security upgrade
summary: >-
  CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that
  skip the security upgrade
severity: medium
cvss: 4.4
cwe:
  - CWE-306
vendor: CoreWCF
product: CoreWCF.UnixDomainSocket
ecosystem: nuget
affected:
  - CoreWCF.UnixDomainSocket < 1.8.1
  - 'CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.UnixDomainSocket 1.8.1
  - CoreWCF.UnixDomainSocket 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-wjpq-6766-7f5j'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j'
  - url: 'https://github.com/advisories/GHSA-wjpq-6766-7f5j'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.434Z'
epss: 0.00152
epssPercentile: 0.03624
---

## Overview

### Impact
A CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and Security.Transport.ClientCredentialType = PosixIdentity) does not require the client to perform the application/unixposix stream upgrade before dispatching messages.

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
Restrict filesystem access to the UDS socket file using owner/group/mode (e.g. chmod 0660 plus a dedicated group) so that only the POSIX users who are already authorized to invoke the service can connect at all. This makes the missing-upgrade behaviour equivalent to the operating system’s filesystem permissions instead of relying on framing-layer identity checks.
Avoid relying on ServiceSecurityContext.PrimaryIdentity for authorization decisions, or back it up with an authentication-required authorization policy that rejects anonymous principals.

## Affected packages

- `CoreWCF.UnixDomainSocket < 1.8.1`
- `CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.UnixDomainSocket 1.8.1`
- `CoreWCF.UnixDomainSocket 1.9.1`