Is CVE-2026-42083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42083 being exploited in the wild.

How severe is CVE-2026-42083?

High severity, with a CVSS score of 8.2, published 27 May 2026.

Which products and versions are affected?

free5GC <= 4.2.1; free5GC PCF < 1.4.3; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

Is there a fix for CVE-2026-42083?

Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42083 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42083?

Check whether you run free5GC, free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42083: free5GC PCF missing authorization in SMPolicyControl and UEPolicyControl

Q: Which products and versions are affected?

free5GC <= 4.2.1; free5GC PCF < 1.4.3; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

Q: Is there a fix for CVE-2026-42083?

Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42083 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-42083?

Check whether you run free5GC, free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42083 · Severity: high · CVSS 8.2 · Published 2026-05-27

A vulnerability in the free5GC Policy Control Function (PCF) allows unauthorized access to mobile subscriber session policies. The PCF is a core component of 5G networks responsible for managing policy rules for subscriber data sessions. An attacker with network access to the PCF can bypass security checks to view or modify session policies and leak sensitive subscriber identifiers (SUPI), potentially compromising user privacy and network operations.

Technologies: free5GC, free5GC PCF, github.com/free5gc/pcf (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-42083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42083 being exploited in the wild.
How severe is CVE-2026-42083?: High severity, with a CVSS score of 8.2, published 27 May 2026.
Which products and versions are affected?: free5GC <= 4.2.1; free5GC PCF < 1.4.3; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.
Is there a fix for CVE-2026-42083?: Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42083 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42083?: Check whether you run free5GC, free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later
```
go get github.com/free5gc/pcf@v1.4.3
```

Technical details

The free5GC Policy Control Function (PCF) fails to apply the 'RouterAuthorizationCheck' middleware to the 'smPolicyGroup' route group within the Npcf_SMPolicyControl service. This omission allows unauthenticated network requests to reach sensitive business logic handlers for session management policies. An attacker can exploit this to perform POST, GET, and DELETE operations on SM policies without a valid OAuth token. Successful exploitation can lead to the disclosure of the Subscription Permanent Identifier (SUPI) and other policy context data. The issue is fixed in version 1.4.3 by correctly attaching the authorization middleware to the affected route groups.

Affected products

free5gc pcf < 1.4.3

Identifiers

CVE-2026-42083
GHSA-6rgm-gr97-x3j5
GO-2026-5189

Timeline

2026-05-07: advisory: GHSA-6rgm-gr97-x3j5 published
2026-05-07: disclosed
2026-05-27: other: NVD published CVE-2026-42083

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.