Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44329free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

Critical 10.0

In plain English

A critical-severity missing authentication in free5gc from free5gc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.3%top 73.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/free5gc/smf	1.4.3	GHSA-3258-qmv8-frp3
Go	github.com/free5gc/smf	1.4.3	GO-2026-4995

Affected products (as reported)

Vendor	Product	Versions
free5gc	free5gc	< 4.2.2

Weakness: CWE-306, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

References

https://github.com/free5gc/free5gc/security/advisories/GHSA-3258-qmv8-frp3 x_refsource_CONFIRM
https://github.com/free5gc/free5gc/issues/887 x_refsource_MISC
https://github.com/free5gc/smf/pull/197 x_refsource_MISC
https://github.com/free5gc/smf/commit/e23ce97565f285eb99eed153743c62bf4c767c6e x_refsource_MISC