Junglewise Threat Intelligence

CVE-2026-10157: Open5GS improper authentication in NGAP PathSwitchRequest handler

CVE-2026-10157 · Severity: high · CVSS 7.3 · Published 2026-05-31

Technologies: Open5GS. Vendors: Open5GS.

Executive brief

Open5GS is an open-source implementation of 5G and 4G mobile core networks. A security vulnerability was found where the system fails to properly verify security settings during a mobile device's transition between base stations. A malicious actor could exploit this to overwrite security configurations, potentially leading to a persistent denial of service for mobile users or unauthorized changes to how their data is encrypted.

Technical details

A vulnerability in Open5GS (up to v2.7.6) exists within the Access and Mobility Management Function (AMF) due to improper implementation of 3GPP TS 33.501 §6.7.3.1. Specifically, in `src/amf/ngap-handler.c`, the AMF fails to verify the `UESecurityCapabilities` IE received in an `NGAP PathSwitchRequest` against locally stored values. Instead, it unconditionally overwrites the stored security context with the values provided in the request. A malicious gNB can exploit this by sending a request with zeroed or arbitrary security capabilities. These corrupted values are then propagated to legitimate gNBs in subsequent `HandoverRequest` messages, causing them to reject the UE due to a lack of matching security algorithms, resulting in a persistent denial of service. A patch has been released in commit a188e36b1741ffc2252133f59b1bda4f14d3cb5c.

Affected products

  • Open5GS Open5GS up to 2.7.6

Timeline

  • 2026-05-11: patched: Patch committed to repository
  • 2026-05-31: disclosed: CVE published

References

Related threats