PT-2026-39257 · Free5Gc+1 · Free5Gc+1

Linziyuu · Published 2026-05-08 · Updated 2026-05-27 · CVE-2026-44327

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2

Description The Network Exposure Function (NEF) mounts the 'nnef-oam' route group without requiring inbound OAuth2 or bearer-token authorization. A network attacker with access to the NEF on the Service Based Interface (SBI) can access the OAM route without an Authorization header, resulting in a 200 OK response. While the current OAM handler is a stub that returns null, the defect is scoped to the entire route group. Consequently, any future Operations, Administration, and Maintenance (OAM) operations added to this group will lack an authentication boundary by default, allowing anonymous probing and potential unauthorized execution of future administrative functions.

Recommendations Update to version 4.2.2.

Exploit

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2026-44327

GHSA-CMPJ-2X3G-M7G3

Affected Products

Free5Gc

Github.Com/Free5Gc/Nef

References · 6

• 🔥 https://github.com/free5gc/free5gc/security/advisories/GHSA-cmpj-2x3g-m7g3 · Exploit
• 🔥 https://github.com/free5gc/free5gc/issues/861 · Exploit
• https://github.com/free5gc/nef/pull/23 · Patch
• https://osv.dev/vulnerability/GHSA-cmpj-2x3g-m7g3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44327 · Security Note
• https://github.com/free5gc/free5gc · Note