CVE-2026-44330

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44330", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:00:06.023Z", "datePublished": "2026-05-27T15:36:40.809Z", "dateUpdated": "2026-05-27T18:47:32.545Z"}, "containers": {"cna": {"title": "free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w"}], "affected": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"version": "< 4.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T15:36:40.809Z"}, "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2."}], "source": {"advisory": "GHSA-rwww-x45w-p52w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T18:47:29.139152Z", "id": "CVE-2026-44330", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:47:32.545Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44330", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-27T18:47:29.139152Z"}}}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:47:12.477Z"}}], "cna": {"title": "free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions", "source": {"advisory": "GHSA-rwww-x45w-p52w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "free5gc", "product": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w", "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T15:36:40.809Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44330", "state": "PUBLISHED", "dateUpdated": "2026-05-27T18:47:32.545Z", "dateReserved": "2026-05-05T19:00:06.023Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T15:36:40.809Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "free5gc", "vendor": "free5gc", "versions": [{"status": "affected", "version": "< 4.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F", "versionEndExcluding": "4.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2."}, {"lang": "es", "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de 4.2.2, el NEF de free5GC monta el grupo de rutas nnef-pfdmanagement sin autorizaci\u00f3n de entrada OAuth2/token de portador. Un atacante de red que puede alcanzar el NEF en la SBI puede usar un token de portador falsificado o arbitrario (p. ej., Authorization: Bearer not-a-real-token) para leer datos de aplicaciones PFD a trav\u00e9s de GET /applications y GET /applications/{appID}, y para crear o eliminar suscripciones de notificaci\u00f3n de cambio de PFD a trav\u00e9s de POST /subscriptions y DELETE /subscriptions/{subID}. Misma causa ra\u00edz que los otros hallazgos de SBI del NEF: el grupo de rutas se monta sin ning\u00fan middleware de autenticaci\u00f3n de entrada. A diferencia de los grupos OAM y de influencia de tr\u00e1fico, nnef-pfdmanagement S\u00cd est\u00e1 declarado en la ServiceList en tiempo de ejecuci\u00f3n, por lo que este es el camino previsto para producci\u00f3n que los operadores esperan que est\u00e9 protegido por la configuraci\u00f3n de OAuth2 receive from NRF: true -- y no lo est\u00e1. Esta vulnerabilidad est\u00e1 corregida en 4.2.2."}], "id": "CVE-2026-44330", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44330", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T18:47:29.139152Z", "version": "2.0.3"}}]}, "published": "2026-05-27T17:16:38.713", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "free5gc", "source": "cna", "vendor": "free5gc"}, "product": "free5gc", "vendor": "free5gc"}], "created": "2026-05-27T19:45:40.914234+00:00", "updated": "2026-05-28T03:30:05.693748+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$free5gc"]}