CVE-2026-44329

Name of the Vulnerable Software and Affected Versions free5GC version 4.2.1

Description The Session Management Function (SMF) mounts the UPI management route group without OAuth2 or bearer-token authorization middleware. This allows a network attacker with access to the Service Based Interface (SBI) to perform unauthorized operations by sending requests without an Authorization header. The issue is specific to the UPI route group, as other groups like nsmf-oam are correctly protected.

Technical details include the ability to perform the following operations:

This lack of authentication enables an attacker to read the UP-plane topology, poison the SMF's view of UPFs to bias PDU session selection, or disrupt legitimate UPF participation through deletions.