External risk intelligence

free5GC NEF Missing OAuth2 Authorization on OAM Routes

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-44327

The vulnerability affects the Network Exposure Function (NEF) within a 5G core network implementation. While the SBI (Service Based Interface) is network-reachable, 5G core components are typically deployed within isolated, controlled carrier or private network environments behind multiple layers of security, rather than being exposed directly to the public internet.

Missing Authentication

Free5gc

before 4.2.2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a flaw in the authorization for a specific network function within the free5GC software, an open-source 5G core network implementation. The issue allows unauthenticated access to certain administrative operations, posing a risk if this function is exposed. The primary concern is confirming if and how this specific component is utilized within your environment.

Unsecured network access to critical functions.
Affects core 5G network software.
Confirm relevance and exposure in your setup.

Attack Path

How an attacker could exploit the issue

An attacker who can reach the Network Exposure Function (NEF) on the Service Based Interface (SBI) can access administrative operations without authentication. This occurs because the NEF mounts the nnef-oam route group without proper authorization checks, allowing unauthenticated requests to be processed. Although the current handler is a stub, any future operations added to this route group will inherit this vulnerability.

Network access to NEF required.
OAM route accessed without authorization.
Unauthorized access to future operations.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated network attacker to access sensitive operations within the Network Exposure Function (NEF) by bypassing authorization checks. The NEF's OAM (Operations, Administration, and Maintenance) route group lacks proper authorization, meaning any future operations added to this group could also be vulnerable.

NEF OAM functionality.
Unauthenticated network access to NEF.
Potential for unauthorized operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The free5GC implementation of the 5G core network's Network Exposure Function (NEF) is vulnerable, potentially impacting organizations running this software. The first practical move is to identify all instances of free5GC, confirm their accessibility and business criticality, and locate the accountable owner for remediation planning.

Ownership: Platform or Network Function owners.
Verification: Confirm NEF exposure and reachability.
Action: Plan for upgrade or access control.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is free5GC and why is it used?

free5GC is an open-source software suite designed to implement the core network architecture for 5G mobile communications. It provides the essential control and user-plane functions required to manage 5G service connectivity, enabling developers and organizations to build, test, or deploy private and specialized 5G networks.

What does CVE-2026-44327 mean for system security?

This vulnerability involves a missing authorization boundary, categorized as CWE-306 and CWE-862. Specifically, the Network Exposure Function (NEF) fails to require OAuth2 or bearer tokens for its administrative OAM route group. This means the software processes requests for these management paths without verifying the identity or permissions of the requester, creating a structural defect in how access is enforced.

How can an attacker trigger this vulnerability?

An attacker must be able to reach the Network Exposure Function over the Service Based Interface. If they can send a request to the OAM route group, the system will respond with a 200 OK status even without any authorization headers. Note that simply reaching the network does not imply the administrative functions themselves are fully active; the bug exists at the route group level, regardless of whether specific OAM operations are currently fully implemented.

Do I need to worry about this if my NEF is internal?

Halo Surface Signal notes that while the vulnerability is network-reachable, 5G core components like the NEF are typically deployed within isolated, controlled carrier or private network environments rather than on the public internet. If your architecture relies on these internal security layers to restrict access to the Service Based Interface, the practical risk is significantly lower than for a system directly exposed to external traffic.

When should I update my free5GC deployment?

You should prioritize upgrading to version 4.2.2 or later as your primary response. Before applying the update, identify where free5GC is running in your environment, confirm the network reachability of the NEF component, and coordinate with your platform owners to schedule the patch, ensuring all future administrative operations added to the OAM group are properly protected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.