Improper Input Validation in free5GC Allows Network Function Manipulation

CVE-2026-55068

What is CVE-2026-55068?

An input validation issue in free5GC allows the NRF RegisterNFInstance handler to accept malformed NF Profiles. These profiles bypass critical validations such as UUID format, nfStatus enum values, and mandatory fields, leading to potential exploitation by attackers. When invalid profiles are stored in the MongoDB NfProfile collection, they may be retrievable via NFDiscover. This exploitation could allow attackers to introduce malicious network function endpoints, jeopardizing control-plane signaling, exposing sensitive credentials, compromising service discovery integrity, and potentially causing service interruptions across dependent network functions. Users are advised to upgrade to version 4.2.3 to mitigate this risk.

References