PT-2026-39259 · Free5Gc · Free5Gc

Linziyuu · Published 2026-05-08 · Updated 2026-05-28 · CVE-2026-44329

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions free5GC version 4.2.1

Description The Session Management Function (SMF) mounts the UPI management route group without OAuth2 or bearer-token authorization middleware. This allows a network attacker with access to the Service Based Interface (SBI) to perform unauthorized operations by sending requests without an Authorization header. The issue is specific to the UPI route group, as other groups like nsmf-oam are correctly protected.

Technical details include the ability to perform the following operations:

• Read operations via the endpoint '/upi/v1/upNodesLinks'.
• Write operations via the endpoint '/upi/v1/upNodesLinks' using a POST request to inject attacker-controlled UPF nodes and link payloads.
• Delete operations via the endpoint '/upi/v1/upNodesLinks/{nodeID}'.

This lack of authentication enables an attacker to read the UP-plane topology, poison the SMF's view of UPFs to bias PDU session selection, or disrupt legitimate UPF participation through deletions.

Exploit

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2026-44329

GHSA-3258-QMV8-FRP3

GO-2026-4995

Affected Products

Free5Gc

References · 9

• 🔥 https://github.com/free5gc/free5gc/security/advisories/GHSA-3258-qmv8-frp3 · Exploit
• 🔥 https://github.com/free5gc/free5gc/issues/887 · Exploit
• https://github.com/free5gc/smf/pull/197 · Patch
• https://github.com/free5gc/smf/commit/e23ce97565f285eb99eed153743c62bf4c767c6e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-44329 · Security Note
• https://osv.dev/vulnerability/GHSA-3258-qmv8-frp3 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4995 · Vendor Advisory
• https://github.com/free5gc/free5gc · Note
• https://twitter.com/DailyCVEBrief/status/2060094541860925677 · Twitter Post