CVE-2026-42083 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI. In NewServer(), the smPolicyGroup route group is created and routes are applied without attaching the router authorization middleware. In contrast, other PCF service groups such as Npcf_PolicyAuthorization do attach RouterAuthorizationCheck before route registration. Because the middleware is missing, requests to the /npcf-smpolicycontrol/v1/sm-policies, /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}, /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/update, and /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/delete endpoints can reach business logic even when no valid OAuth token is provided. This vulnerability is fixed in 4.2.2.
An authentication middleware vulnerability has been identified in free5GC's PCF component, specifically within the Npcf_SMPolicyControl service. This issue, present in versions prior to 4.2.2, allows unauthenticated access to SM policy handlers and the disclosure of subscriber SUPI. The vulnerability arises because the smPolicyGroup route is registered without the necessary authorization middleware, in contrast to other PCF service groups that do enforce such checks. As a result, endpoints related to SM policy control can be accessed without a valid OAuth token, bypassing authentication and potentially exposing sensitive subscriber information.
Users can upgrade to free5GC version 4.2.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/844 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-6rgm-gr97-x3j5 | CISA-ADP | Issue TrackingVendor Advisory |
| https://github.com/free5gc/free5gc/issues/844 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-6rgm-gr97-x3j5 | [email protected] | Issue TrackingVendor Advisory |
| https://github.com/free5gc/pcf/commit/8c4d457cdf58bb239ee30e88c56b370b22073964 | [email protected] | Patch |
| https://github.com/free5gc/pcf/pull/63 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |