CVE-2026-40246 Details
Description
free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execution continues and the subscription is deleted regardless. An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by supplying any value for the influenceId path segment, while the API misleadingly returns a 404 Not Found response. A patched version was not available at the time of publication.
A vulnerability exists in the free5GC UDR service in versions through 4.2.1, allowing unauthenticated deletion of Traffic Influence Subscriptions. The issue arises from improper path validation in the subscription deletion handler, which fails to correctly enforce the expected path segment. Instead of terminating the request after sending a 404 Not Found response for invalid path segments, the handler continues execution and deletes the subscription. This flaw can be exploited by sending a DELETE request with an arbitrary influenceId, while the API misleadingly indicates that the resource was not found. The vulnerability is present in any free5GC instance where the 5G Service Based Interface is accessible to untrusted parties, such as through misconfigured network segmentation or a compromised internal host.
The vulnerability has been patched in free5GC version 4.2.2 by adding the missing return statement in the subscription deletion handler, ensuring that invalid path segments are properly rejected before any deletion occurs.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-g9cw-qwhf-24jp | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | <= 1.4.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | New CVE Received | [email protected] |