PT-2026-39255 · Free5Gc+1 · Free5Gc+1

Linziyuu · Published 2026-05-08 · Updated 2026-05-27 · CVE-2026-44325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2

Description The NRF root SBI endpoint "POST /oauth2/token" contains a parser-level type-confusion bug. The handler in NFs/nrf/internal/sbi/api accesstoken.go uses reflection over models.NrfAccessTokenAccessTokenReq but only special-cases plain string and NrfNfManagementNfType fields, treating all other fields as models.PlmnId. When an attacker provides a field name in the form body that is incompatible with the models.PlmnId type (such as a slice or a different struct), the reflect.Value.Set() function triggers a panic. While the Gin recovery mechanism converts these panics into HTTP 500 errors, the endpoint remains remotely panicable via unauthenticated form-encoded requests. This can be triggered using several parameters, including requesterPlmnList, requesterSnssaiList, requesterSnpnList, targetSnpn, targetSnssaiList, and targetNsiList.

Recommendations Update to version 4.2.2.

Exploit

Fix

RCE

Improper Handling of Exceptional Conditions

Type Confusion

Weakness Enumeration

CWE-20

CWE-755

CWE-843

Related Identifiers

CVE-2026-44325

GHSA-F8QV-7X5W-QR48

Affected Products

Free5Gc

Github.Com/Free5Gc/Nrf

References · 7

• 🔥 https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48 · Exploit
• 🔥 https://github.com/free5gc/free5gc/issues/918 · Exploit
• https://github.com/free5gc/nrf/commit/f7bc77daa7425506af7569f2e61c2a210f5a0423 · Patch
• https://github.com/free5gc/nrf/pull/83 · Patch
• https://osv.dev/vulnerability/GHSA-f8qv-7x5w-qr48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44325 · Security Note
• https://github.com/free5gc/free5gc · Note