CVE-2026-42459: free5GC UDM information disclosure via improper SUPI validation

Executive brief

Free5GC UDM, a component used in 5G core networks for managing subscriber data, is vulnerable to information disclosure. An unauthenticated attacker can send specially crafted requests that cause the system to reveal internal network addresses and API structures. This sensitive information could be used to plan more targeted attacks against the internal 5G infrastructure.

Technical details

The free5GC UDM component contains an improper input validation vulnerability in six GET handlers within the 'nudm-sdm' service. Specifically, the 'supi' path parameter is not validated using 'validator.IsValidSupi()' before being processed. An unauthenticated remote attacker can inject control characters into this parameter. When UDM attempts to forward the request to the Unified Data Repository (UDR), the Go 'net/url' parser fails and generates an error. UDM then returns a 500 Internal Server Error response that includes the full internal UDR URL, hostname, port, and API path structure in the 'detail' field. This is a regression or missed fix related to CVE-2026-27642.

Affected products

• free5gc udm <= 1.4.3

Timeline

• 2026-05-07: advisory: GitHub Advisory published
• 2026-05-27: disclosed: NVD publication date

References

• https://api.github.com/users/Giancannella
• https://github.com/Giancannella
• https://api.github.com/users/Giancannella/gists%7B/gist_id%7D
• https://api.github.com/users/Giancannella/repos
• https://avatars.githubusercontent.com/u/56028149?v=4
• https://api.github.com/users/Giancannella/events%7B/privacy%7D