CVE-2026-44315

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44315", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:00:06.022Z", "datePublished": "2026-05-27T15:52:51.027Z", "dateUpdated": "2026-05-27T17:22:44.713Z"}, "containers": {"cna": {"title": "free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf"}, {"name": "https://github.com/free5gc/free5gc/issues/858", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/free5gc/issues/858"}, {"name": "https://github.com/free5gc/nef/pull/23", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/nef/pull/23"}], "affected": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"version": "< 4.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T15:52:51.027Z"}, "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2."}], "source": {"advisory": "GHSA-5f62-53r8-qrqf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T17:20:44.790265Z", "id": "CVE-2026-44315", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T17:22:44.713Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44315", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T17:20:44.790265Z"}}}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T17:19:22.684Z"}}], "cna": {"title": "free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions", "source": {"advisory": "GHSA-5f62-53r8-qrqf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/free5gc/free5gc/issues/858", "name": "https://github.com/free5gc/free5gc/issues/858", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/free5gc/nef/pull/23", "name": "https://github.com/free5gc/nef/pull/23", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T15:52:51.027Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44315", "state": "PUBLISHED", "dateUpdated": "2026-05-27T17:22:44.713Z", "dateReserved": "2026-05-05T19:00:06.022Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T15:52:51.027Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "free5gc", "vendor": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F", "versionEndExcluding": "4.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2."}, {"lang": "es", "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de la versi\u00f3n 4.2.2, el NEF de free5GC monta la API 3gpp-pfd-management sin autorizaci\u00f3n de entrada OAuth2/bearer-token. Un atacante de red que puede alcanzar el NEF en la SBI puede crear, leer y eliminar el estado de las transacciones de gesti\u00f3n de PFD con un token portador falsificado o arbitrario (p. ej., Authorization: Bearer not-a-real-token). El grupo de rutas tambi\u00e9n es accesible incluso cuando la ServiceList de la configuraci\u00f3n en ejecuci\u00f3n no lo declara, por lo que los operadores que creen haber deshabilitado el servicio a trav\u00e9s de la configuraci\u00f3n siguen expuestos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.2.2."}], "id": "CVE-2026-44315", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44315", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T17:20:44.790265Z", "version": "2.0.3"}}]}, "published": "2026-05-27T17:16:36.430", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/free5gc/free5gc/issues/858"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/free5gc/nef/pull/23"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "free5gc", "source": "cna", "vendor": "free5gc"}, "product": "free5gc", "vendor": "free5gc"}], "created": "2026-05-27T21:15:25.916594+00:00", "updated": "2026-05-28T02:15:03.985455+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$free5gc"]}