CVE-2026-55068

Name of the Vulnerable Software and Affected Versions free5GC versions 4.2.2 and earlier

Description The RegisterNFInstance handler at the endpoint PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} fails to validate NF profiles against 3GPP TS 29.510 constraints. This allows an attacker with Service-Based Architecture (SBI) access to register fake network-function profiles with arbitrary values. Specifically, the handler does not enforce the UUID v4 format for nfInstanceId, valid enum values for nfStatus, numeric ranges for heartBeatTimer, mandatory profile fields, or IP address constraints for nfServices.ipEndPoints.

These invalid profiles are persisted in the MongoDB NfProfile collection and are subsequently returned to other network functions via the NFDiscover process. This enables an attacker to advertise attacker-controlled endpoints, redirecting control-plane signaling. Consequently, this can lead to the interception of control-plane traffic, harvesting of OAuth2 credentials, and denial of service across all network functions that trust the Network Repository Function (NRF).

Recommendations Update to version 4.2.3. As a temporary mitigation, restrict access to the PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} endpoint to ensure only trusted network functions can register profiles.