CVE-2026-44326

The NEF (Network Exposure Function) component in free5GC mounts a routing group for the 3gpp-traffic-influence API without Authorization header verification — both requests without any token and requests with arbitrarily fabricated bearer tokens are accepted. Moreover, the vulnerable routing group remains available even if the operator disabled the service in the configuration (ServiceList), making administrative disabling ineffective. An attacker can thereby create, read, modify, and delete traffic-influence subscriptions, including subscriptions with the AnyUeInd=true flag affecting all traffic of a group or any UE.

An attacker can seize control over traffic control policies in the 5G network — by creating, modifying, or deleting traffic-influence subscriptions, they can disrupt or redirect traffic of all network users (AnyUeInd=true), leading to loss of integrity and availability of network services. Unauthorized reading of subscription data is also possible.

Update free5GC to version 4.2.2 or later, in which the fix has been implemented. Details are available in the official security advisory from the vendor and pull request #23 in the free5gc/nef repository.

free5GC (open-source implementation of 5G core network) in versions prior to 4.2.2 — NEF (Network Exposure Function) component.