CVE-2026-44315— free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44315
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
Source: NVD (National Vulnerability Database)
Vulnerability Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44315
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44315
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-44315 (1)
Vendor Advisories for CVE-2026-44315 (1)
Proof of Concept for CVE-2026-44315 (1)
Same Patch Batch · free5gc · 2026-05-27 · 20 CVEs total
| CVE-2026-44327 | 10.0 CRITICAL | free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM hand |
| CVE-2026-44329 | 10.0 CRITICAL | free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read |
| CVE-2026-44330 | 10.0 CRITICAL | free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD |
| CVE-2026-44326 | 9.4 CRITICAL | free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer token |
| CVE-2026-42083 | 8.2 HIGH | free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated |
| CVE-2026-44328 | 8.2 HIGH | free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF |
| CVE-2026-44322 | 7.5 HIGH | free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure d |
| CVE-2026-44316 | 7.5 HIGH | free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 v |
| CVE-2026-44319 | 7.5 HIGH | free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-contr |
| CVE-2026-44321 | 7.5 HIGH | free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools ( |
| CVE-2026-44325 | 7.5 HIGH | free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflec |
| CVE-2026-44320 | 7.3 HIGH | free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are ac |
| CVE-2026-44324 | 6.5 MEDIUM | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface |
| CVE-2026-44317 | 6.5 MEDIUM | free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing |
| CVE-2026-44318 | 6.5 MEDIUM | free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF proc |
| CVE-2026-42081 | 6.1 MEDIUM | free5GC: UE Security Capability bypass on NGAP PathSwitchRequest |
| CVE-2026-44323 | 4.3 MEDIUM | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exist |
| CVE-2026-42082 | 3.7 LOW | free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover |
| CVE-2026-42459 | free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive In |
IV. Related Vulnerabilities
Same product: free5gc
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-42082
free5GC: Missing Concurrent NAS SMC Validation During NGAP H - CVE-2026-42083
free5GC: PCF Npcf_SMPolicyControl missing authentication mid - CVE-2026-42459
free5GC: Improper Input Validation and Generation of Error M - CVE-2026-44316
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics o
Same vendor: free5gc
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-42082
free5GC: Missing Concurrent NAS SMC Validation During NGAP H - CVE-2026-42083
free5GC: PCF Npcf_SMPolicyControl missing authentication mid - CVE-2026-42459
free5GC: Improper Input Validation and Generation of Error M - CVE-2026-44316
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics o
Same weakness: CWE-862
- CVE-2026-44848
Portainer: Missing authorization on Docker plugin endpoints - CVE-2026-44849
Portainer: Endpoint security bypass via Swarm service create - CVE-2026-44884
Portainer: Missing authorization on custom template file end - CVE-2026-42071
MantisBT: Private Bugnote Attachment Content Leak via REST A - CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey ref
V. Comments for CVE-2026-44315
No comments yet