Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-42083free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI

High 8.2

In plain English

A high-severity missing authorization in free5gc from free5gc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 74.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI. In NewServer(), the smPolicyGroup route group is created and routes are applied without attaching the router authorization middleware. In contrast, other PCF service groups such as Npcf_PolicyAuthorization do attach RouterAuthorizationCheck before route registration. Because the middleware is missing, requests to the /npcf-smpolicycontrol/v1/sm-policies, /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}, /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/update, and /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/delete endpoints can reach business logic even when no valid OAuth token is provided. This vulnerability is fixed in 4.2.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/free5gc/pcf	1.4.3	GHSA-6rgm-gr97-x3j5
Go	github.com/free5gc/pcf	1.4.3	GO-2026-5189

Affected products (as reported)

Vendor	Product	Versions
free5gc	free5gc	< 4.2.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/free5gc/free5gc/security/advisories/GHSA-6rgm-gr97-x3j5 x_refsource_CONFIRM
https://github.com/free5gc/free5gc/issues/844 x_refsource_MISC
https://github.com/free5gc/pcf/pull/63 x_refsource_MISC
https://github.com/free5gc/pcf/commit/8c4d457cdf58bb239ee30e88c56b370b22073964 x_refsource_MISC