CVE-2026-40245: free5gc UDR information disclosure in nudr-dr service

Executive brief

An information disclosure vulnerability exists in the free5GC Unified Data Repository (UDR), a component used in 5G core networks to store subscriber data. An unauthenticated attacker with network access to the internal service interface can retrieve a full list of sensitive subscriber identifiers (SUPI/IMSI). This exposure allows for the tracking of mobile users and undermines the privacy protections built into 5G standards.

Technical details

An information disclosure vulnerability exists in the free5GC UDR service within the 'HandleApplicationDataInfluenceDataSubsToNotifyGet' function. The handler validates that at least one query parameter is provided; however, when validation fails, it sends an HTTP 400 error but fails to 'return', allowing execution to proceed to the data retrieval logic. An unauthenticated attacker can send a GET request to the '/nudr-dr/v2/application-data/influenceData/subs-to-notify' endpoint without parameters to receive a response containing both the error message and the full list of Traffic Influence Subscriptions, including SUPI/IMSI values. This bypasses 3GPP privacy mechanisms designed to conceal subscriber identities. The issue is fixed by adding missing return statements in the SBI API repository handler.

Affected products

• free5gc udr <= 1.4.2

Timeline

• 2026-04-14: advisory: GitHub Advisory published
• 2026-04-16: disclosed: NVD publication date

References

• https://api.github.com/users/Giancannella
• https://github.com/Giancannella
• https://api.github.com/users/Giancannella/gists%7B/gist_id%7D
• https://api.github.com/users/Giancannella/repos
• https://avatars.githubusercontent.com/u/56028149?v=4
• https://api.github.com/users/Giancannella/events%7B/privacy%7D