Vulnerability details

CVE-2026-44329

free5gc free5gc

free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

CVSS 3.1

10.0Critical

Official description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

CVSS scores

Score	Version	Source	Vector
10.0Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
free5gc	free5gc	< 4.2.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/free5gc/smf/pull/197 x_refsource_MISC
https://github.com/free5gc/smf/commit/e23ce97565f285eb99eed153743c62bf4c767c6e x_refsource_MISC
https://github.com/free5gc/free5gc/security/advisories/GHSA-3258-qmv8-frp3 x_refsource_CONFIRM
https://github.com/free5gc/free5gc/issues/887 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-27
Last updated: 2026-05-28
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.33%

Probability of exploitation in 30 days

26.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-306
Missing Authentication for Critical Function
CWE-862
Missing Authorization