Is CVE-2026-44315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44315 being exploited in the wild.

How severe is CVE-2026-44315?

Critical severity, with a CVSS score of 9.4, published 27 May 2026.

Which products and versions are affected?

free5GC <= 1.2.3; free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Is there a fix for CVE-2026-44315?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44315 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44315?

Check whether you run free5GC, free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44315: free5GC NEF missing authorization in 3gpp-pfd-management API

Q: Which products and versions are affected?

free5GC <= 1.2.3; free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Q: Is there a fix for CVE-2026-44315?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44315 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-44315?

Check whether you run free5GC, free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44315 · Severity: critical · CVSS 9.4 · Published 2026-05-27

The Network Exposure Function (NEF) in the free5GC 5G core network contains a security flaw where a critical management interface is left unprotected. This component is responsible for exposing network capabilities to external applications. An attacker can use this flaw to manipulate network policies, potentially redirecting or intercepting mobile traffic, and can also delete legitimate network configurations, leading to service outages.

Technologies: free5GC, free5GC NEF, github.com/free5gc/nef (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44315 being exploited in the wild.
How severe is CVE-2026-44315?: Critical severity, with a CVSS score of 9.4, published 27 May 2026.
Which products and versions are affected?: free5GC <= 1.2.3; free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.
Is there a fix for CVE-2026-44315?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44315 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44315?: Check whether you run free5GC, free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The free5GC Network Exposure Function (NEF) fails to implement inbound authentication (CWE-306) and authorization (CWE-862) for the 3gpp-pfd-management API. The route group is mounted without middleware to validate OAuth2 bearer tokens, meaning any arbitrary or forged token is accepted. This allows a network-adjacent or remote attacker with access to the Service Based Interface (SBI) to perform CRUD operations on Packet Flow Description (PFD) transactions. These transactions are written to the Unified Data Repository (UDR) and used by the Session Management Function (SMF) and User Plane Function (UPF) for traffic classification, enabling policy poisoning or denial of service. The vulnerability persists even if the service is not explicitly declared in the configuration's ServiceList.

Affected products

free5GC nef <= 1.2.3
free5GC free5GC <= v4.2.1

Identifiers

CVE-2026-44315
GHSA-5f62-53r8-qrqf
GO-2026-5142

Timeline

2026-03-11: other: Vulnerability validated in lab environment
2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
2026-05-08: advisory: GitHub Advisory published
2026-05-27: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.