CVE-2026-54776

Published: Jul 8, 2026Modified: Jul 9, 2026Deferred

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.8 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (6)

https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3

Source: security-advisories@github.com

https://github.com/CoreWCF/CoreWCF/commit/9af16955e51a57348dafce0019e259a092ef7440

Source: security-advisories@github.com

https://github.com/CoreWCF/CoreWCF/commit/f2f1a05927a88b8a75fa0582fa8ed75eb891e463

Source: security-advisories@github.com

https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1

Source: security-advisories@github.com

https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1

Source: security-advisories@github.com

https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j

Source: security-advisories@github.com

Timeline

No history available yet.