Traffic Influence Subscription Vulnerability in free5GC UDR Service

CVE-2026-40248

What is CVE-2026-40248?

The UDR service in free5GC, an open-source 5G core network implementation, is susceptible to an input validation flaw. Specifically, the handler for creating or updating Traffic Influence Subscriptions fails to terminate execution after producing an HTTP 404 response for invalid influenceId path segments. As a result, an attacker with unauthenticated access to the 5G Service Based Interface can illegitimately create or overwrite Traffic Influence Subscriptions. The exploitation enables the attacker to inject malicious notificationUri values and manipulate arbitrary Subscription Permanent Identifiers (SUPIs) by simply supplying any influenceId value. A patched version addressing this vulnerability is currently not available.

References