Authorization Flaw in github.com/free5gc/nef (CVE-2026-44330)
Summary
Vulnerability in github.com/free5gc/nef (CVE-2026-44330). Data can be tampered with by attackers. Exploitable via GET /applications.
Original description
The description as published by the source.
Summary
free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not.
Details
Validated against the NEF container in the official Docker compose lab.
- Source repo tag:
v4.2.1 - Running Docker image:
free5gc/nef:v4.2.0 - Runtime NEF commit:
5ce35eab - Docker validation date: 2026-03-11
NEF advertises OAuth2 setting receive from NRF: true, but the entire nnef-pfdmanagement route group is mounted with no inbound auth middleware, so forged-token requests reach the read and subscription handlers and execute against UDR-backed state.
Code evidence (paths in free5gc/nef):
- Route group mounted without auth middleware:
NFs/nef/internal/sbi/server.go:56 - Read routes exposed at
/applicationsand `/applications/:appID…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-44330 has been found in github.com/free5gc/nef.
Attackers can target a specific entry point like GET /applications over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 10.0/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "github.com/free5gc/nef CVE-2026-44330" on the vendor's site.
CVE-2026-44330 (github.com/free5gc/nef) — CWE-863 / CVSS v3 10.0
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: GET /applications / GET /applications/{appID} / POST /subscriptions / DELETE /subscriptions/{subID}
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Incorrect authorization (CWE-863) exists in github.com/free5gc/nef. Attackers reach the vulnerable code path via GET /applications without authentication.
Check the vendor advisory for the affected versions of github.com/free5gc/nef. Attack surface: GET /applications / GET /applications/{appID} / POST /subscriptions / DELETE /subscriptions/{subID}.
Severity: Critical (CVSS 10.0/10). Data can be tampered with by attackers.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual GET /applications requests with malformed payloads or SQL meta-characters. Run grep -r 'github.com/free5gc/nef' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/free5gc/nef' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/free5gc/nefを grep し、稼働しているサービス・バージョンを把握する。 -
2Hunt for indicators of compromise detect
grep 'GET /applications' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
GET /applicationsへの異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
3Post-deployment verification verify
Replay attack against GET /applications on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- exploit github.com
- package github.com
- web github.com
- web github.com