CVE-2026-44315
9.4 CRITICALfree5GC is an open-source implementation of the 5G core network
Published: 2026-05-27 · Last updated: 2026-05-28
Severity and scoring
- CVSS
- 9.4 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- CWE
- CWE-862
Affected products
| Vendor | Product |
|---|---|
| free5gc | free5gc |
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-44315
- [Exploit reference]https://github.com/free5gc/free5gc/issues/858
- [Vendor advisory]https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf
- [Other]https://github.com/free5gc/nef/pull/23
- [Vendor advisory]https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf
Related CVEs
Same vendor
- CVE-2026-44330 — free5GC is an open-source implementation of the 5G core network (10.0 CRITICAL)
- CVE-2026-44329 — free5GC is an open-source implementation of the 5G core network (10.0 CRITICAL)
- CVE-2026-44328 — free5GC is an open-source implementation of the 5G core network (8.2 HIGH)
- CVE-2026-44327 — free5GC is an open-source implementation of the 5G core network (10.0 CRITICAL)
- CVE-2026-44326 — free5GC is an open-source implementation of the 5G core network (9.4 CRITICAL)
Same CWE
- CVE-2026-46645 — SQLAdmin is a flexible Admin interface for SQLAlchemy models (4.3 MEDIUM)
- CVE-2026-53634 — Sharp is a content management framework built for Laravel as a package (4.3 MEDIUM)
- CVE-2026-0272 — A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Comm...
- CVE-2026-49822 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)
- CVE-2026-49821 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)