Authorization Bypass in free5GC's NEF OAM Route Group

CVE-2026-44327

What is CVE-2026-44327?

The vulnerability in free5GC's NEF allows network attackers to access the OAM route without proper authorization, as the system lacks an inbound OAuth2/bearer-token check. This oversight results in potential exposure to unauthorized operations on the OAM route. Although the current handler operates minimally, the structural defect implies that all future operations under this route group will also lack adequate authentication, creating significant security risks. The issue has been resolved in version 4.2.2.

References