PT-2026-39260 · Free5Gc · Free5Gc

Linziyuu · Published 2026-05-08 · Updated 2026-05-28 · CVE-2026-44330

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions free5GC version 4.2.1

Description The Network Exposure Function (NEF) mounts the nnef-pfdmanagement route group without inbound OAuth2 or bearer-token authorization. This allows a network attacker with access to the Service-Based Interface (SBI) to use forged or arbitrary bearer tokens to perform unauthorized actions. Specifically, attackers can read PFD application data via the endpoints "/applications" and "/applications/{appID}", and create or delete PFD change-notification subscriptions using "/subscriptions" and "/subscriptions/{subID}". This occurs because the route group is mounted without the necessary inbound authentication middleware, despite being declared in the runtime ServiceList where operators expect protection via NRF-issued OAuth2.

Recommendations Update free5GC to a version that incorporates the fix from pull request 23 in the NEF repository. As a temporary workaround, restrict network access to the NEF Service-Based Interface (SBI) to ensure only trusted entities can reach the nnef-pfdmanagement endpoints.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44330

GHSA-RWWW-X45W-P52W

Affected Products

Free5Gc

References · 7

• 🔥 https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44330 · Security Note
• https://osv.dev/vulnerability/GHSA-rwww-x45w-p52w · Vendor Advisory
• https://github.com/free5gc/free5gc/issues/862 · Note
• https://github.com/free5gc/free5gc · Note
• https://t.me/cveNotify/164996 · Telegram Post
• https://twitter.com/vulert_official/status/2053839499416006840 · Twitter Post