What is the CVSS score of CVE-2026-54776?

CVE-2026-54776 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-54776?

Yes, a patch is available for CVE-2026-54776. Update the affected software to the latest version immediately.

CoreWCF UnixDomainSocket CVE-2026-54776

MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-19 https://github.com/CoreWCF/CoreWCF

GHSA-wjpq-6766-7f5j

Authentication Bypass

4.4

CVSS 3.1 · Vendor: https://github.com/CoreWCF/CoreWCF

Severity by source

Vendor (https://github.com/CoreWCF/CoreWCF) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

UDS socket access requires a local low-privilege OS account (AV:L, PR:L); bypass impacts service data and operations at limited scope with no availability effect (C:L/I:L/A:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).

CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 21:49 vuln.today

Analysis Generated

Jun 19, 2026 - 21:49 vuln.today

DescriptionCVE.org

Impact

A CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and Security.Transport.ClientCredentialType = PosixIdentity) does not require the client to perform the application/unixposix stream upgrade before dispatching messages.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Restrict filesystem access to the UDS socket file using owner/group/mode (e.g. chmod 0660 plus a dedicated group) so that only the POSIX users who are already authorized to invoke the service can connect at all. This makes the missing-upgrade behaviour equivalent to the operating system’s filesystem permissions instead of relying on framing-layer identity checks. Avoid relying on ServiceSecurityContext.PrimaryIdentity for authorization decisions, or back it up with an authentication-required authorization policy that rejects anonymous principals.

AnalysisAI

Authentication bypass in CoreWCF.UnixDomainSocket (NuGet) allows local OS users to invoke service operations without completing the required POSIX identity security upgrade, rendering framing-layer identity checks ineffective. Services using UnixDomainSocketBinding with Security.Mode = TransportCredentialOnly and ClientCredentialType = PosixIdentity are affected - the server dispatches messages before the application/unixposix stream upgrade is performed, meaning the caller's identity resolves as anonymous or unintended. No public exploit code has been identified and this is not listed in CISA KEV; however, the flaw is a complete bypass of the sole authentication mechanism for this binding configuration.

Technical ContextAI

CoreWCF is the open-source .NET implementation of Windows Communication Foundation, and the affected NuGet package CoreWCF.UnixDomainSocket (pkg:nuget/corewcf.unixdomainsocket) provides Unix Domain Socket (UDS) transport support. When UnixDomainSocketBinding is configured with Security.Mode = TransportCredentialOnly and ClientCredentialType = PosixIdentity, the intended behavior is that clients must complete an application-layer stream upgrade negotiation (the application/unixposix step) before messages are accepted, allowing the server to resolve the client's OS-level POSIX identity. CWE-306 (Missing Authentication for Critical Function) describes the root cause: the server fails to enforce completion of this upgrade step before dispatching service messages. Because PosixIdentity is the only credential mechanism in this binding mode, skipping the upgrade means the transport authentication gate is entirely absent - there is no fallback identity mechanism. Affected versions are CoreWCF.UnixDomainSocket below 1.8.1 (stable line) and the 1.9.x branch below 1.9.1.

RemediationAI

The primary fix is to upgrade the CoreWCF.UnixDomainSocket NuGet package to version 1.8.1 (for consumers on the 1.8.x stable track) or version 1.9.1 (for consumers on the 1.9.x line), as confirmed by the vendor advisory at https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j. If immediate patching is not feasible, two compensating controls are available. First, restrict OS filesystem access to the UDS socket file using chmod 0660 combined with a dedicated OS group containing only authorized users; this delegates identity enforcement to the kernel filesystem layer and is effective, but requires disciplined group membership management since any user added to the group gains the ability to connect. Second, remove authorization logic that depends on ServiceSecurityContext.PrimaryIdentity, or supplement it with an explicit authorization policy that explicitly rejects anonymous principals - this bounds the impact of the bypass even if the missing upgrade behavior persists, though it does not eliminate the root cause. Both workarounds are documented in the vendor advisory.