# CVE-2026-40245: free5gc UDR information disclosure in nudr-dr service

Source: https://junglewise.ai/threats/cve-2026-40245-free5gc-udr-information-disclosure-in-nudr-dr-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40245 · Severity: high · CVSS 7.5 · Published 2026-04-14

An information disclosure vulnerability exists in the free5GC Unified Data Repository (UDR), a component used in 5G core networks to store subscriber data. An unauthenticated attacker with network access to the internal service interface can retrieve a full list of sensitive subscriber identifiers (SUPI/IMSI). This exposure allows for the tracking of mobile users and undermines the privacy protections built into 5G standards.

Technologies: [free5GC Udr](https://junglewise.ai/threats/technologies/udr), [github.com/free5gc/udr (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-udr). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40245 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40245 being exploited in the wild.

**How severe is CVE-2026-40245?** High severity, with a CVSS score of 7.5, published 14 April 2026.

**Which products and versions are affected?** free5GC Udr <= 1.4.2; github.com/free5gc/udr (Go) <= 1.4.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.2.

**Is there a fix for CVE-2026-40245?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40245 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40245?** Check whether you run free5GC Udr or github.com/free5gc/udr (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the free5GC UDR service within the 'HandleApplicationDataInfluenceDataSubsToNotifyGet' function. The handler validates that at least one query parameter is provided; however, when validation fails, it sends an HTTP 400 error but fails to 'return', allowing execution to proceed to the data retrieval logic. An unauthenticated attacker can send a GET request to the '/nudr-dr/v2/application-data/influenceData/subs-to-notify' endpoint without parameters to receive a response containing both the error message and the full list of Traffic Influence Subscriptions, including SUPI/IMSI values. This bypasses 3GPP privacy mechanisms designed to conceal subscriber identities. The issue is fixed by adding missing return statements in the SBI API repository handler.

## Affected products

- free5gc udr <= 1.4.2

## Identifiers

- CVE-2026-40245
- GHSA-wrwh-rpq4-87hf
- GO-2026-5722

## Timeline

- 2026-04-14: advisory: GitHub Advisory published
- 2026-04-16: disclosed: NVD publication date

## References

- [https://api.github.com/users/Giancannella](https://api.github.com/users/Giancannella)
- [https://github.com/Giancannella](https://github.com/Giancannella)
- [https://api.github.com/users/Giancannella/gists%7B/gist_id%7D](https://api.github.com/users/Giancannella/gists%7B/gist_id%7D)
- [https://api.github.com/users/Giancannella/repos](https://api.github.com/users/Giancannella/repos)
- [https://avatars.githubusercontent.com/u/56028149?v=4](https://avatars.githubusercontent.com/u/56028149?v=4)
- [https://api.github.com/users/Giancannella/events%7B/privacy%7D](https://api.github.com/users/Giancannella/events%7B/privacy%7D)

## Related threats

- [free5GC UDR improper input validation in EE subscription handlers](https://junglewise.ai/threats/cve-2026-47780-free5gc-udr-improper-input-validation-in-ee-subscription-handlers)
- [free5GC UDR denial of service via nil type assertion](https://junglewise.ai/threats/cve-2026-44324-free5gc-udr-denial-of-service-via-nil-type-assertion)
- [free5GC UDR nil pointer dereference in nudr-dr DELETE handler](https://junglewise.ai/threats/cve-2026-44323-free5gc-udr-nil-pointer-dereference-in-nudr-dr-delete-handler)
- [free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation](https://junglewise.ai/threats/cve-2026-40343-free5gc-udr-fail-open-handling-in-policydatasubstonotifypost)
- [free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions](https://junglewise.ai/threats/cve-2026-40246-free5gc-udr-improper-path-validation-allows-unauthenticated)