CVE-2026-54777
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in CoreWCF NetNamedPipe transport allows a local attacker to intercept network traffic by attaching to a pre-existing named pipe instance before the server fully creates it. The issue affects versions prior to 1.8.1 and 1.9.1.
Risk Assessment
An attacker with local access can intercept sensitive data transmitted over NetNamedPipe, compromising the confidentiality of inter-process communication on the same host.
Recommendation
Immediately update CoreWCF to version 1.8.1 or 1.9.1, which contain the fix that closes the race window vulnerability.
Other vulnerabilities in CoreWCF
See all- CVE-2026-54782Critical
A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.
- CVE-2026-54784High
In CoreWCF version 1.9.0, SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used. This allows an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic.
- CVE-2026-54783High
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an attacker to replay a captured signed SOAP envelope to execute arbitrary service operations as the victim. The issue stems from missing verification that the ds:Signature covers the expected Security header target.
- CVE-2026-54781High
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows bypassing SubjectConfirmation method URI and holder-of-key proof key validation in SAML tokens. An attacker can exploit this to downgrade holder-of-key or use custom confirmation method assertions to authenticate without proving authority over the assertion.
- CVE-2026-54780Low
Vulnerability in CoreWCF (a port of WCF for .NET Core) versions prior to 1.8.1 and 1.9.1. The WS-Security 1.0 receive pipeline validates the ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA-1 while the message is still accepted.
- CVE-2026-54779Medium
A vulnerability in the CoreWCF library causes SAML token replay protection to be inoperative. The DefaultTokenReplayCache.TryAdd method does not reject duplicate tokens even when DetectReplayedTokens is enabled, allowing a captured token to be reused.
- CVE-2026-54778Medium
A vulnerability in CoreWCF prior to versions 1.8.1 and 1.9.1 causes UnixDomainSocket POSIX peer identity resolution to use non-reentrant getpwuid and getgrgid calls. Under contention, this can attribute one connection's identity to another or crash the host process.
- CVE-2026-54776Medium
A vulnerability in CoreWCF allows bypassing PosixIdentity authentication in services hosted on Unix Domain Sockets. An attacker can send messages without the required stream upgrade, bypassing framing-layer identity checks.
- CVE-2026-54775Medium
A vulnerability in CoreWCF allows an attacker with Kafka produce permissions to cause a persistent denial of service (DoS) on an endpoint. When KafkaTransportPump receives a null-value tombstone record, the service stops processing new records from the Kafka topic.
- CVE-2026-54774High
A vulnerability in the CoreWCF library allows SAML signature verification to be skipped when a non-X.509 signing token is used. An attacker can reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification.
Original NVD description (English source)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.