External risk intelligence

free5GC NEF API allows unauthorized PFD management via forged tokens.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-44315

free5GC is a 5G core network component. The vulnerable API resides on the Service Based Interface (SBI), which is typically restricted to internal network communication between 5G core network functions within a private operator environment. While network-reachable, these interfaces are generally not exposed to the public internet in standard deployments.

Free5gc

before 4.2.2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in free5GC, an open-source 5G core network component, that could allow unauthorized access to sensitive network functions. This vulnerability permits a network attacker to potentially manipulate critical network state information, even if the service is configured to be disabled.

Unsecured network access to core 5G functions.
Undermines service configuration and network control.
Assess exposure and confirm relevance to our network.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by reaching the free5GC NEF component over the network. This can be achieved by sending requests with a forged or arbitrary bearer token to the 3gpp-pfd-management API. Even if operators believe the service is disabled, it remains accessible, potentially allowing the attacker to manipulate PFD-management transaction state.

Network access to NEF is required.
Triggered by arbitrary bearer tokens.
Allows unauthorized PFD management.

Live Threat

Current exploitation, exposure, and threat context

A network attacker who can reach the free5GC NEF on the SBI could potentially manipulate the 3Gpp PFD management API. This could occur even if the service is believed to be disabled via configuration, by using a forged or arbitrary bearer token.

PFD management transaction state.
Forged token over SBI network.
Unauthorized API control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The free5GC NEF component is vulnerable to unauthorized access to PFD-management APIs, allowing network attackers to manipulate PFD transaction states. This issue affects all versions prior to 4.2.2, and the vulnerability remains even if the ServiceList configuration appears to disable the affected route group. Responsibility for addressing this likely falls to the 5G core network infrastructure or platform teams, in coordination with any vendor management teams if free5GC was procured externally. The immediate first step is to confirm the presence of affected free5GC instances, assess their reachability from the Service Based Interface (SBI), and identify the accountable owner to plan remediation.

Own by 5G core infrastructure or platform teams.
Verify NEF API reachability on the SBI.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is free5GC?

free5GC is an open-source software platform designed to implement the 5G core network. It provides the essential infrastructure components that manage 5G connectivity, authentication, and subscriber data, acting as the foundation for modern cellular network services.

What does CVE-2026-44315 mean?

This CVE describes a Missing Authorization vulnerability (CWE-862). It means the system fails to verify the identity of someone accessing the 3gpp-pfd-management API. Consequently, the application accepts forged or arbitrary bearer tokens, allowing unauthorized users to read, create, or delete sensitive transaction state data.

How can an attacker trigger this vulnerability?

An attacker can trigger the issue by sending network requests directly to the Service Based Interface (SBI) of the NEF component. The vulnerability is active even if the operator has attempted to disable the service via the configuration file, as the route group remains reachable despite these settings.

Is my deployment at risk from this vulnerability?

Halo Surface Signal indicates that while the vulnerability is network-reachable, it resides on the Service Based Interface (SBI). This interface is typically restricted to internal communication between core network functions within a private operator environment, making public internet exposure unlikely for standard deployments.

How should I respond to CVE-2026-44315?

Your first step is to identify all running free5GC instances in your environment. Confirm which versions are in use and verify their reachability on the SBI. If you are running any version prior to 4.2.2, coordinate with your 5G core infrastructure or platform teams to plan an update to version 4.2.2 or later.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.