External risk intelligence

free5GC NRF Instance Registration Validation Bypass Allows Control Plane Signaling Redirection.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-55068

This vulnerability affects the Service-Based Interface (SBI) of a 5G Core network function. While network-reachable within the telecommunications infrastructure, these components are designed to reside within isolated, secured internal core network segments, not on the public internet. Public exposure would require highly unusual and insecure configuration.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in free5GC, an open-source 5G core network implementation, that could allow an attacker to impersonate network functions and redirect control-plane signaling. This could expose credentials, compromise service discovery, and disrupt network services.

Uncontrolled inputs enable network function impersonation.
Could lead to credential exposure and service disruption.
Verify relevance and assess internal exposure.

Attack Path

How an attacker could exploit the issue

An attacker with access to the Service-Based Interface could send malformed network function profiles to the NRF. The NRF, without proper validation, would store these invalid profiles. Later, when other network functions query the NRF for available services, they would receive the attacker-controlled information, allowing the attacker to redirect critical network traffic.

Requires network access to the SBI.
Triggers when NRF registers invalid profiles.
Allows traffic redirection and credential exposure.

Live Threat

Current exploitation, exposure, and threat context

An attacker with access to the Service-Based Interface could manipulate the registration of network functions within the 5G core. By providing malformed registration profiles, an attacker could cause the Network Repository Function (NRF) to incorrectly record network function endpoints. This could lead to control-plane signaling being redirected to attacker-controlled locations, potentially exposing credentials and disrupting services.

Network function credentials and signaling data.
Malicious network function registration.
Disrupted 5G core services.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams are responsible for managing the free5GC NRF service, which handles network function registration and discovery. The first step is to identify all instances of the affected free5GC version, confirm their reachability and business criticality, and assign an owner for remediation planning.

Ownership: Platform or application teams.
Verify: NRF reachability and criticality.
Action: Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is free5GC?

free5GC is an open-source software platform designed to build 5G core network functions. It provides the essential infrastructure components that manage device connectivity, session handling, and service registration, essentially acting as the back-end 'brain' for mobile 5G network operations.

What does CVE-2026-55068 mean for network security?

This vulnerability is a form of Improper Input Validation (CWE-20). It means the Network Repository Function (NRF) fails to check if the data it receives is formatted correctly. Because it accepts 'garbage' input without verifying required fields or data types, an attacker can trick the system into storing fake network function profiles that look legitimate to other parts of the network.

How is this vulnerability triggered?

An attacker must have network access to the Service-Based Interface (SBI) of the free5GC NRF. By sending a specially crafted registration request to the NRF, they can register malicious endpoints. Importantly, this flaw is not triggered by standard, well-formed configuration updates; it specifically requires the submission of invalid or malformed data structures that the software currently fails to reject.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal labels this as 'Unlikely' because the affected Service-Based Interface is designed to reside deep within secured, isolated core network segments rather than on the public internet. While you should confirm your network architecture, the vulnerability is typically only reachable if your 5G core components have been exposed outside of their intended, protected environment through an unusual or insecure configuration.

What steps should I take if I use free5GC?

First, conduct an inventory to identify all instances running version 4.2.2 or earlier. Once identified, evaluate the network accessibility of these instances to determine their potential exposure. The primary remediation is to upgrade your free5GC installation to version 4.2.3 or later, which includes the necessary input validation checks to prevent the registration of malicious network profiles.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.