Skip to content
Heist/ feed
Back to feed
Critical

free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

Type: advisorySources: OSV

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-44315
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 18:30 UTC · Revision 1

Source evidence

free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

core-osv · Original source

Published 27 May 2026, 15:52 UTC

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.

osv:CVE-2026-44315
Complete source record
{
  "id": "bab57f3a8053e0c9f89b2ad54f40bdcb4cd39456a122e95561b785fd4bde6a96",
  "url": "https://osv.dev/vulnerability/CVE-2026-44315",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions",
    "summary": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.",
    "evidence": "osv:CVE-2026-44315",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-44315",
      "aliases": [
        "CVE-2026-44315",
        "GHSA-5f62-53r8-qrqf",
        "GO-2026-5142"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/free5gc/free5gc",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "8b0f4445fc931638fb624463ce3572a203517679"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.2.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.2.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.2.1",
            "v4.2.0",
            "v4.1.0",
            "v4.0.1",
            "v4.0.0",
            "v3.4.5",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0",
            "v3.0.7",
            "v3.0.6",
            "v3.0.5"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44315.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.242236880Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44315.json",
        "https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-44315",
        "https://github.com/free5gc/free5gc/issues/858",
        "https://github.com/free5gc/nef/pull/23"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44315.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-44315",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505713,
  "published_at": "2026-05-27T15:52:51.027+00:00"
}