Is CVE-2026-40245 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40245 being exploited in the wild.

How severe is CVE-2026-40245?

High severity, with a CVSS score of 7.5, published 14 April 2026.

Which products and versions are affected?

free5GC Udr <= 1.4.2; github.com/free5gc/udr (Go) <= 1.4.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.2.

Is there a fix for CVE-2026-40245?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40245 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40245?

Check whether you run free5GC Udr or github.com/free5gc/udr (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40245: free5gc UDR information disclosure in nudr-dr service

Q: Which products and versions are affected?

free5GC Udr <= 1.4.2; github.com/free5gc/udr (Go) <= 1.4.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.2.

Q: Is there a fix for CVE-2026-40245?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-40245 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-40245?

Check whether you run free5GC Udr or github.com/free5gc/udr (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40245 · Severity: high · CVSS 7.5 · Published 2026-04-14

An information disclosure vulnerability exists in the free5GC Unified Data Repository (UDR), a component used in 5G core networks to store subscriber data. An unauthenticated attacker with network access to the internal service interface can retrieve a full list of sensitive subscriber identifiers (SUPI/IMSI). This exposure allows for the tracking of mobile users and undermines the privacy protections built into 5G standards.

Technologies: free5GC Udr, github.com/free5gc/udr (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-40245 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40245 being exploited in the wild.
How severe is CVE-2026-40245?: High severity, with a CVSS score of 7.5, published 14 April 2026.
Which products and versions are affected?: free5GC Udr <= 1.4.2; github.com/free5gc/udr (Go) <= 1.4.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.2.
Is there a fix for CVE-2026-40245?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40245 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40245?: Check whether you run free5GC Udr or github.com/free5gc/udr (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in the free5GC UDR service within the 'HandleApplicationDataInfluenceDataSubsToNotifyGet' function. The handler validates that at least one query parameter is provided; however, when validation fails, it sends an HTTP 400 error but fails to 'return', allowing execution to proceed to the data retrieval logic. An unauthenticated attacker can send a GET request to the '/nudr-dr/v2/application-data/influenceData/subs-to-notify' endpoint without parameters to receive a response containing both the error message and the full list of Traffic Influence Subscriptions, including SUPI/IMSI values. This bypasses 3GPP privacy mechanisms designed to conceal subscriber identities. The issue is fixed by adding missing return statements in the SBI API repository handler.

Affected products

free5gc udr <= 1.4.2

Identifiers

CVE-2026-40245
GHSA-wrwh-rpq4-87hf
GO-2026-5722

Timeline

2026-04-14: advisory: GitHub Advisory published
2026-04-16: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.