Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-44329

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

View on NVD

Analysis

The free5GC open-source 5G core network implementation has a critical authentication bypass in its Session Management Function (SMF). Remote attackers can interact with UPI management endpoints without any authorization, allowing them to read, modify, or delete UP-nodes and links within the 5G core.

Severity

Score: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: LOW
I: HIGH
A: HIGH
Weakness (CWE): CWE-306CWE-862

EPSS

Probability of exploitation (next 30 days): 0.0005 (0.0%)
Percentile: 15.0%
EPSS: 2026-05-28

Affects

free5gc:free5gc

Technical description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

Published: 5/27/2026, 5:16:38 PM
Last modified: 5/28/2026, 4:23:13 PM

References

HomeEventsBlogResourcesTeam