Unauthorized Access in Free5GC's NEF API Exposes Core Network Functions

CVE-2026-44315

What is CVE-2026-44315?

The NEF (Network Exposure Function) of free5GC, an open-source 5G core network implementation, is susceptible to unauthorized access due to improper OAuth2/bearer-token authorization handling prior to version 4.2.2. Network attackers with access to the Service Based Interface (SBI) can exploit this vulnerability, enabling them to create, read, and delete PFD-management transaction states with a forged or arbitrary bearer token. Importantly, even if operators have configured their ServiceList to disable the service, the route group remains publicly accessible, potentially exposing sensitive operations to exploitation.

References