CVE-2026-44330
CriticalSummary
In versions prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without OAuth2/bearer-token authorization. A network attacker can use a forged token to access PFD application data and manage change-notification subscriptions.
Risk Assessment
The lack of proper authorization may lead to unauthorized access to sensitive data and manipulation of subscriptions, posing a serious threat to the security of the 5G network.
Recommendation
It is recommended to upgrade to version 4.2.2 or later to secure the NEF against unauthorized access by implementing proper OAuth2 authorization.
Other vulnerabilities in free5GC NEF
See all- CVE-2026-44320High
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-callback route group, allowing the use of a forged token to access the SMF-callback handler. The lack of authorization enables attackers to manipulate the actual subscription state.
- CVE-2026-44319High
In versions prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. An attacker can create a PFD subscription with an attacker-chosen notifyUri and trigger a PFD change, leading to NEF failure.
- CVE-2026-44327Critical
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-oam route group. A network attacker could access the OAM route without an authorization header, resulting in a 200 OK response.
- CVE-2026-44326Critical
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the 3gpp-traffic-influence API. A network attacker could create, read, patch, and delete traffic-influence subscriptions without proper authorization headers.
- CVE-2026-44315Critical
free5GC is an open-source implementation of the 5G core network. Prior to version 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the PFD management API, allowing attackers to manipulate PFD transaction state using a forged token.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS