free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed. This vulnerability is fixed in 4.2.2.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf Exploit, Vendor Advisory
- https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.4 · free5gcNVD modified 2026-10-14 20:10
Affected (CPE criteria) 1
cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
References 4
- https://github.com/free5gc/free5gc/issues/858 Exploit, Issue Tracking
- https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf Exploit, Vendor Advisory
- https://github.com/free5gc/nef/pull/23 Issue Tracking
- https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf Exploit, Vendor Advisory