# CVE-2026-42083: free5GC PCF missing authorization in SMPolicyControl and UEPolicyControl

Source: https://junglewise.ai/threats/cve-2026-42083-free5gc-pcf-missing-authorization-in-smpolicycontrol-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-42083 · Severity: high · CVSS 8.2 · Published 2026-05-27

A vulnerability in the free5GC Policy Control Function (PCF) allows unauthorized access to mobile subscriber session policies. The PCF is a core component of 5G networks responsible for managing policy rules for subscriber data sessions. An attacker with network access to the PCF can bypass security checks to view or modify session policies and leak sensitive subscriber identifiers (SUPI), potentially compromising user privacy and network operations.

Technologies: [free5GC](https://junglewise.ai/threats/technologies/free5gc), [free5GC PCF](https://junglewise.ai/threats/technologies/pcf), [github.com/free5gc/pcf (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-pcf). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42083 being exploited in the wild.

**How severe is CVE-2026-42083?** High severity, with a CVSS score of 8.2, published 27 May 2026.

**Which products and versions are affected?** free5GC <= 4.2.1; free5GC PCF < 1.4.3; github.com/free5gc/pcf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

**Is there a fix for CVE-2026-42083?** Yes. github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42083 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42083?** Check whether you run free5GC, free5GC PCF or github.com/free5gc/pcf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/free5gc/pcf (Go): upgrade to 1.4.3 or later

  ```sh
  go get github.com/free5gc/pcf@v1.4.3
  ```


## Technical details

The free5GC Policy Control Function (PCF) fails to apply the 'RouterAuthorizationCheck' middleware to the 'smPolicyGroup' route group within the Npcf_SMPolicyControl service. This omission allows unauthenticated network requests to reach sensitive business logic handlers for session management policies. An attacker can exploit this to perform POST, GET, and DELETE operations on SM policies without a valid OAuth token. Successful exploitation can lead to the disclosure of the Subscription Permanent Identifier (SUPI) and other policy context data. The issue is fixed in version 1.4.3 by correctly attaching the authorization middleware to the affected route groups.

## Affected products

- free5gc pcf < 1.4.3

## Identifiers

- CVE-2026-42083
- GHSA-6rgm-gr97-x3j5
- GO-2026-5189

## Timeline

- 2026-05-07: advisory: GHSA-6rgm-gr97-x3j5 published
- 2026-05-07: disclosed
- 2026-05-27: other: NVD published CVE-2026-42083

## References

- [https://api.github.com/users/LinZiyuu](https://api.github.com/users/LinZiyuu)
- [https://github.com/LinZiyuu](https://github.com/LinZiyuu)
- [https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D](https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D)
- [https://api.github.com/users/LinZiyuu/repos](https://api.github.com/users/LinZiyuu/repos)
- [https://avatars.githubusercontent.com/u/104151270?v=4](https://avatars.githubusercontent.com/u/104151270?v=4)
- [https://api.github.com/users/LinZiyuu/events%7B/privacy%7D](https://api.github.com/users/LinZiyuu/events%7B/privacy%7D)

## Related threats

- [Free5GC SMF resource exhaustion in PFCP session establishment](https://junglewise.ai/threats/cve-2026-106805-a-resource-exhaustion-issue-exists-in-free5gc-v4-2-3-during-pfcp)
- [Free5GC race condition in GMM handler RanUe context access](https://junglewise.ai/threats/cve-2026-94043-a-vulnerability-was-determined-in-free5gc-up-to-4-2-3-this)
- [Free5GC UPF nil pointer dereference in PFCP Session Report](https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report)
- [free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration)
- [free5gc NSSF nil pointer dereference in NssaiAvailabilitySubscriptionCreate](https://junglewise.ai/threats/cve-2026-30073-free5gc-nssf-nil-pointer-dereference-in)