CVE-2026-44327 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OAM route with no Authorization header at all and the handler returns 200 OK. The current OAM handler is a stub that returns null, but the structural defect is route-group-scoped: the entire OAM route group has no inbound auth middleware, so every future OAM operation added to this group inherits the missing auth boundary by default. This vulnerability is fixed in 4.2.2.
A vulnerability exists in free5GC's NEF component, specifically in versions through 4.2.1, where the 'nnef-oam' route group is mounted without proper OAuth2 authorization. This flaw allows network attackers to access the OAM route on the Service-Based Interface (SBI) without an Authorization header, receiving a 200 OK response instead. Although the current OAM handler is a placeholder that returns null, the lack of authentication middleware for the entire OAM route group poses a risk, as any future operations added to this group would inherit this authentication gap by default.
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-cmpj-2x3g-m7g3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/861 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-cmpj-2x3g-m7g3 | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/nef/pull/23 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |