CVE-2026-44315

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.

CVSS v3 9.4 CRITICAL

9.4^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/free5gc/free5gc/issues/858	Exploit Issue Tracking
https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf	Exploit Vendor Advisory
https://github.com/free5gc/nef/pull/23	Issue Tracking
https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) free5GC es una implementación de código abierto de la red central 5G. Antes de la versión 4.2.2, el NEF de free5GC monta la API 3gpp-pfd-management sin autorización de entrada OAuth2/bearer-token. Un atacante de red que puede alcanzar el NEF en la SBI puede crear, leer y eliminar el estado de las transacciones de gestión de PFD con un token portador falsificado o arbitrario (p. ej., Authorization: Bearer not-a-real-token). El grupo de rutas también es accesible incluso cuando la ServiceList de la configuración en ejecución no lo declara, por lo que los operadores que creen haber deshabilitado el servicio a través de la configuración siguen expuestos. Esta vulnerabilidad está corregida en la versión 4.2.2.

Information

Published : 2026-05-27 17:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-44315

Mitre link : CVE-2026-44315

CVE.ORG link : CVE-2026-44315

JSON object : View

Products Affected

free5gc

free5gc

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44315", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44315", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T17:20:44.790265Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}]}], "published": "2026-05-27T17:16:36.430", "references": [{"url": "https://github.com/free5gc/free5gc/issues/858", "tags": ["Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/free5gc/nef/pull/23", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2."}, {"lang": "es", "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de la versi\u00f3n 4.2.2, el NEF de free5GC monta la API 3gpp-pfd-management sin autorizaci\u00f3n de entrada OAuth2/bearer-token. Un atacante de red que puede alcanzar el NEF en la SBI puede crear, leer y eliminar el estado de las transacciones de gesti\u00f3n de PFD con un token portador falsificado o arbitrario (p. ej., Authorization: Bearer not-a-real-token). El grupo de rutas tambi\u00e9n es accesible incluso cuando la ServiceList de la configuraci\u00f3n en ejecuci\u00f3n no lo declara, por lo que los operadores que creen haber deshabilitado el servicio a trav\u00e9s de la configuraci\u00f3n siguen expuestos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.2.2."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F", "versionEndExcluding": "4.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}