CVE-2026-44330

10.0 CRITICAL

free5GC is an open-source implementation of the 5G core network

Published: 2026-05-27 · Last updated: 2026-05-28

Severity and scoring

CVSS: 10.0 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CWE: CWE-863

Affected products

Vendor	Product
free5gc	free5gc

Description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-44330
[Vendor advisory]https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w
[Vendor advisory]https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w

Related CVEs

Same vendor

CVE-2026-44329 — free5GC is an open-source implementation of the 5G core network (10.0 CRITICAL)
CVE-2026-44328 — free5GC is an open-source implementation of the 5G core network (8.2 HIGH)
CVE-2026-44327 — free5GC is an open-source implementation of the 5G core network (10.0 CRITICAL)
CVE-2026-44326 — free5GC is an open-source implementation of the 5G core network (9.4 CRITICAL)
CVE-2026-44325 — free5GC is an open-source implementation of the 5G core network (7.5 HIGH)

Same CWE

CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
CVE-2026-53738 — Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler (8.1 HIGH)
CVE-2026-49824 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (8.5 HIGH)
CVE-2026-49823 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)
CVE-2026-48860 — Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the dis...