PT-2026-38368 · Free5Gc+1 · Free5Gc+1

Linziyuu · Published 2026-05-07 · Updated 2026-05-28 · CVE-2026-42083

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2

Description The PCF Npcf SMPolicyControl service lacks authentication middleware in the NewServer() function, where the smPolicyGroup route group is created without attaching the RouterAuthorizationCheck middleware. This allows unauthenticated requests to bypass OAuth token validation and reach business logic. This issue can lead to the disclosure of subscriber SUPI (Subscription Permanent Identifier). The affected endpoints are "/npcf-smpolicycontrol/v1/sm-policies", "/npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}", "/npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/update", and "/npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/delete".

Recommendations Update to version 4.2.2.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-42083

GHSA-6RGM-GR97-X3J5

Affected Products

Free5Gc

Github.Com/Free5Gc/Pcf

References · 8

• 🔥 https://github.com/free5gc/free5gc/issues/844 · Exploit
• 🔥 https://github.com/free5gc/free5gc/security/advisories/GHSA-6rgm-gr97-x3j5 · Exploit
• https://github.com/free5gc/pcf/commit/8c4d457cdf58bb239ee30e88c56b370b22073964 · Patch
• https://github.com/free5gc/pcf/pull/63 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42083 · Security Note
• https://osv.dev/vulnerability/GHSA-6rgm-gr97-x3j5 · Vendor Advisory
• https://github.com/free5gc/free5gc · Note
• https://t.me/cveNotify/165083 · Telegram Post