5G Core Network Vulnerability in Free5GC UDR Service

CVE-2026-40246

What is CVE-2026-40246?

The UDR service of Free5GC, an open-source 5G core network implementation, contains a security flaw that permits unauthorized deletion of Traffic Influence Subscriptions. In affected versions, particularly 1.4.2 and below, the system fails to properly halt execution after a validation for a path segment called influenceId returns a 404 Not Found response. This oversight allows an unauthenticated attacker to exploit the 5G Service Based Interface, enabling them to delete arbitrary subscriptions by entering any value for influenceId. The misleading response doesn't provide the necessary indication of failure, thereby posing a significant threat to network integrity and service reliability.

References