CVE-2026-44315
CriticalSummary
free5GC is an open-source implementation of the 5G core network. Prior to version 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the PFD management API, allowing attackers to manipulate PFD transaction state using a forged token.
Risk Assessment
A network attacker could gain access to sensitive PFD management operations, leading to potential security breaches and data loss. Organizations that have not updated their software are at risk of attacks.
Recommendation
It is recommended to upgrade to version 4.2.2 or later to mitigate this vulnerability. A configuration audit should also be conducted to ensure services are properly secured.
Original NVD description (English source)
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.