CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Priority LOW 30CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00117 1st percentileScored 2026-11-07
Fix Fixed CoreWCF (CoreWCF): 1.9.1, 1.8.1CoreWCF.NetNamedPipe (NuGet): 1.8.1, 1.9.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CoreWCF | CoreWCF | 1.9.0 to before 1.9.1; before 1.8.1 | 1.9.1, 1.8.1 | Patch available | CNA |
| — | CoreWCF.NetNamedPipe (NuGet) | before 1.8.1 | 1.8.1 | Patch available | GHSA-6jj2-4q5c-x8g6 |
| — | CoreWCF.NetNamedPipe (NuGet) | 1.9.0 to before 1.9.1 | 1.9.1 | Patch available | GHSA-6jj2-4q5c-x8g6 |
- CoreWCF VendorCoreWCF Affected 1.9.0 to before 1.9.1; before 1.8.1 Fixed in 1.9.1, 1.8.1 Patch available CNA
- CoreWCF.NetNamedPipe (NuGet) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-6jj2-4q5c-x8g6
- CoreWCF.NetNamedPipe (NuGet) Vendor— Affected 1.9.0 to before 1.9.1 Fixed in 1.9.1 Patch available GHSA-6jj2-4q5c-x8g6
Remediation
- Fix · CNA CoreWCF (CoreWCF) Fixed in 1.9.1, 1.8.1
- Fix · GHSA-6jj2-4q5c-x8g6 CoreWCF.NetNamedPipe (NuGet) Fixed in 1.8.1 Advisory →
- Fix · GHSA-6jj2-4q5c-x8g6 CoreWCF.NetNamedPipe (NuGet) Fixed in 1.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54777
- 2026-10-03 Alias added: GHSA-6jj2-4q5c-x8g6
References
Other 6
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6
- https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7
- https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF
More CoreWCF vulnerabilities
- TI-2026-39588 CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation CVSS 3.1CRITICAL 10.0
- TI-2026-39578 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake CVSS 3.1HIGH 7.5
- TI-2024-18811 CoreWCF NetFraming based services can leave connections open when they should be closed CVSS 3.1HIGH 7.5
- TI-2026-39590 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality CVSS 3.1HIGH 7.4
- TI-2026-39589 Authentication bypass by capture-replay in CoreWCF CVSS 3.1HIGH 7.4
- TI-2026-39587 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced CVSS 3.1HIGH 7.4
Sources
- CVE-2026-54777 · CVE Program
- CVE-2026-54777 · NVD
- FIRST EPSS
- GHSA-6jj2-4q5c-x8g6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences