CVE-2026-54776: CoreWCF Unix Domain Socket Authentication Bypass

Technical summary

The vulnerability stems from improper enforcement of the application/unixposix stream upgrade mechanism in the UnixPosixIdentitySecurityUpgradeProvider component. When a CoreWCF service listens on Unix Domain Sockets with PosixIdentity client credentials enabled, the framing layer should validate that clients complete the upgrade before message dispatch occurs. However, the implementation permits connections to bypass this upgrade step entirely, allowing unauthenticated or inadequately-authenticated messages to reach the service dispatcher. This represents a missing authentication check (CWE-306) at the protocol layer. The impact is localized to systems using the specific Unix Domain Socket + PosixIdentity configuration combination.

Business impact

Services relying on CoreWCF for local inter-process communication may inadvertently expose sensitive operations to unauthorized local users. While the CVSS score reflects local-access-only requirements, the business risk depends on deployment context: a microservices architecture using CoreWCF for inter-service communication on shared infrastructure could face privilege escalation or lateral movement risks. Data confidentiality and integrity may be compromised if unauthenticated users access protected operations. The impact is typically contained to the local system unless the service exposes remote functionality.

Affected systems

CoreWCF versions prior to 1.8.1 and 1.9.1 are vulnerable. The vulnerability is specific to services configured to listen on Unix Domain Sockets with PosixIdentity credentials. Services using alternative transports (HTTP, TCP named pipes) or authentication schemes are not affected. Organizations deploying CoreWCF-based services, particularly those offering local inter-process communication in containerized or multi-tenant environments, should inventory their configurations.

Exploitability

Exploitation requires local system access (AV:L) and low complexity (AC:L), making this vulnerability accessible to any unprivileged user on the affected system. No authentication is required (PR:L permits low-privilege accounts), and user interaction is not needed. However, the attacker must be aware of the vulnerable service endpoint and its Unix Domain Socket location. Exploitation does not require network access, limiting the threat to local actors. The vulnerability is not yet tracked in the CISA KEV catalog.

Remediation

Upgrade CoreWCF to version 1.8.1 or later (for the 1.8.x branch) or version 1.9.1 or later (for the 1.9.x branch). Organizations should verify their CoreWCF dependency versions in project files (.csproj) and NuGet package configurations. For services unable to upgrade immediately, restrict local system access through OS-level controls: use Unix file permissions on socket files to limit which users can connect, and employ mandatory access controls (AppArmor, SELinux) if available. Review service configurations to confirm whether PosixIdentity is actually needed; if not, switch to alternative authentication mechanisms.

Patch guidance

Patches are available in CoreWCF 1.8.1 and 1.9.1. Consult the official CoreWCF GitHub repository and release notes to confirm the patch version applicable to your branch. Update dependencies through NuGet: run 'dotnet add package CoreWCF --version [target version]' or update your .csproj PackageReference elements directly. After patching, rebuild and redeploy services, then verify through functional testing that Unix Domain Socket services start correctly and authenticate clients as expected. No breaking changes are documented for these patch versions.

Detection guidance

Monitor CoreWCF service logs for unexpected connection attempts or message dispatch errors. In containerized environments, audit Unix Domain Socket file access using auditd or similar tools to detect unauthorized connection attempts. Network-based detection is ineffective since exploitation occurs over local sockets; focus on host-based monitoring. Review application event logs for authentication failures or protocol violations. Consider adding instrumentation to UnixPosixIdentitySecurityUpgradeProvider or related components to log bypass attempts. In high-security environments, implement file integrity monitoring on socket files to detect unauthorized modifications.

Why prioritize this

While the CVSS score is MEDIUM (4.4), prioritization should reflect the specificity of the vulnerable configuration. Organizations using CoreWCF with Unix Domain Sockets and PosixIdentity in multi-tenant or high-privilege-separation environments should treat this as higher priority. Conversely, services using HTTP or named-pipe transports can safely deprioritize. The absence of KEV listing suggests limited real-world exploitation to date, but the ease of exploitation (low complexity, low privilege) means this could escalate if weaponized tools emerge. Patch availability mitigates urgency.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects attack vector Local (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and scope Unchanged (S:U), with limited impact on confidentiality (C:L) and integrity (I:L) but no availability impact (A:N). The score appropriately captures that only local attackers with basic system access can exploit this, and only services with the specific socket + PosixIdentity configuration are at risk. However, in environments where CoreWCF services handle sensitive inter-process communication, the business consequence may exceed the numeric score.

Frequently asked questions