Unauthorized Access in free5GC Network Functions by Open Source Vendor

CVE-2026-44326

What is CVE-2026-44326?

The free5GC platform, an open-source implementation of the 5G core network, contains a significant vulnerability that allows network attackers to manipulate API access. Prior to version 4.2.2, the NEF failed to enforce proper OAuth2/bearer token authorization on the 3gpp-traffic-influence API. This weakness permits malicious users to create, read, update, or delete traffic-influence subscriptions without any authorization header, or with an invalid bearer token, posing a crucial risk to network operability and security. Furthermore, attackers can exploit this vulnerability even if configurations intended to disable access are in place, leading to exposure of sensitive traffic steering functionalities. Version 4.2.2 addresses and resolves this critical issue.

References