CVE-2026-34762: Ella Networks Ella Core audit log falsification in subscriber API

CVE-2026-34762 · Severity: low · CVSS 3.1 · Published 2026-04-02

Ella Core is a 5G core platform used to manage private cellular networks. A security flaw allows authorized network managers to modify subscriber policies while tricking the system's audit logs into recording the wrong identity. This could allow a malicious administrator to disrupt service for specific users while avoiding detection during a security audit.

Technologies: Ella Networks Ella Core, github.com/ellanetworks/core (Go). Vendors: Ella Networks, Go.

Quick answers

Is CVE-2026-34762 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34762 being exploited in the wild.
How severe is CVE-2026-34762?
Low severity, with a CVSS score of 3.1, published 2 April 2026.
Which products and versions are affected?
Ella Networks Ella Core < 1.8.0; github.com/ellanetworks/core (Go) SEMVER:introduced=0,fixed=1.8.0.
Is there a fix for CVE-2026-34762?
Yes. github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34762 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-34762?
Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later
    go get github.com/ellanetworks/core@v1.8.0

Technical details

An improper input validation vulnerability (CWE-20) exists in the Ella Core 5G platform's subscriber update API. The 'PUT /api/v1/subscriber/{imsi}' endpoint accepts the International Mobile Subscriber Identity (IMSI) in both the URL path and the JSON request body but fails to validate that these identifiers match. An attacker with NetworkManager or Admin privileges can exploit this by providing a target IMSI in the URL path and a different, potentially non-existent IMSI in the request body. This results in the policy modification being applied to the target subscriber while the audit log incorrectly records the action against the IMSI provided in the body, effectively bypassing forensic accountability. The issue is resolved in version 1.8.0 by using the path parameter as the single source of truth.

Affected products

  • Ella Networks Ella Core < 1.8.0

Identifiers

  • CVE-2026-34762
  • GHSA-xw45-cc32-442f
  • GO-2026-5770

Timeline

  • 2026-03-30: patched: Version 1.8.0 released
  • 2026-03-30: advisory: GitHub Security Advisory published
  • 2026-04-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.