CVE-2026-44329Critical· 10.0▾ Midnightfree5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI ca…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.
free5gc < 4.2.2Upgrade past the affected range:
free5gc 4.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44328High· 8.2free5GC is an open-source implementation of the 5G core network
CVE-2026-44320High· 7.3free5GC is an open-source implementation of the 5G core network
CVE-2026-44321High· 7.5free5GC is an open-source implementation of the 5G core network
CVE-2026-44327Critical· 10.0free5GC is an open-source implementation of the 5G core network
CVE-2026-44326Critical· 9.4free5GC is an open-source implementation of the 5G core network
CVE-2026-44315Critical· 9.4free5GC is an open-source implementation of the 5G core network