External risk intelligence

free5GC NEF API Authorization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-44326

The vulnerability exists within the Service Based Architecture (SBI) of a 5G core network implementation. While the attack vector is network-based, these interfaces are designed to be internal control plane components between 5G network functions and are typically isolated from the public internet by design, residing behind secure operator network perimeters.

Free5gc

before 4.2.2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects free5GC, an open-source 5G core network implementation, specifically its Network Exposure Function (NEF) and its handling of traffic influence subscriptions. An attacker could potentially manipulate traffic steering without proper authorization, even if the service was thought to be disabled.

Unauthorized network changes can occur.
It impacts core 5G network functions.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker on the network can reach the free5GC's Network Exposure Function (NEF) component. By not providing a valid authorization token, or by using a fake one, they can manipulate traffic steering subscriptions. This could allow them to affect any user's traffic or groups of users, even if the service appears to be disabled in the configuration.

Network access to NEF required.
Manipulate traffic influence API.
Control over user traffic steering.

Live Threat

Current exploitation, exposure, and threat context

A network attacker could manipulate traffic steering subscriptions within the free5GC NEF component when it's reachable over the Service Based Interface (SBI). This could affect how network traffic is directed for groups of users or individual devices.

Traffic influence subscriptions.
Network access to NEF API.
Unauthorized traffic redirection.

Operational Fix

Recommended remediation, mitigation, and detection steps

The free5GC implementation, specifically its Network Exposure Function (NEF), is vulnerable to unauthenticated API calls that could allow attackers to manipulate traffic steering. Teams responsible for the 5G core network infrastructure and platform management should prioritize identifying NEF instances, assessing their exposure to the internal network, and confirming ownership. Remediation planning should then proceed based on the criticality and reachability of these instances, potentially involving coordination with the free5GC project or relevant vendor-management teams if applicable.

Ownership lies with 5G core infrastructure teams.
Verify NEF reachability and exposure on the internal network.
Plan remediation based on assessed risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is free5GC?

free5GC is an open-source platform used to build and manage 5G core networks. It provides the essential software infrastructure needed to route data and handle signaling for 5G mobile communications, serving as a foundational toolkit for developers and operators building private or experimental 5G environments.

How does CVE-2026-44326 work?

This vulnerability is classified as Missing Authorization (CWE-862). It occurs because the Network Exposure Function (NEF) component fails to verify security tokens for traffic influence requests. Essentially, the system trusts any incoming request to modify traffic steering rules without requiring a valid cryptographic bearer token, allowing unauthorized users to interfere with network traffic paths.

Do I need an account to trigger this bug?

No. You do not need valid credentials or a real authorization token to trigger the vulnerability. An attacker can send requests with no Authorization header at all, or with a completely fabricated token. Simply reaching the Network Exposure Function via the Service Based Interface is sufficient to execute unauthorized commands, even if the service appears disabled in your configuration files.

Is my network affected by this?

According to Halo Surface Signal, this vulnerability impacts components within the Service Based Architecture (SBI) of the 5G core. While these interfaces are typically intended for internal control plane communication and often reside behind secure perimeters, any instance where the NEF is reachable by unauthorized actors on the network—rather than isolated as designed—increases your risk profile.

What should I do to secure my free5GC deployment?

The primary step is to upgrade your free5GC implementation to version 4.2.2 or later, which contains the necessary authorization checks. In the meantime, audit your network architecture to confirm that the Network Exposure Function (NEF) is strictly isolated from untrusted segments and verify that only authorized internal network functions have access to the Service Based Interface.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.