Is CVE-2026-44320 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44320 being exploited in the wild.

How severe is CVE-2026-44320?

High severity, with a CVSS score of 7.3, published 27 May 2026.

Which products and versions are affected?

free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Is there a fix for CVE-2026-44320?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44320 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44320?

Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44320: free5GC NEF missing authentication in nnef-callback route group

Q: Which products and versions are affected?

free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Q: Is there a fix for CVE-2026-44320?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44320 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44320?

Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44320 · Severity: high · CVSS 7.3 · Published 2026-05-27

The free5GC Network Exposure Function (NEF) contains a security flaw where certain communication channels used for receiving notifications are not properly secured. This allows an unauthorized person to send fake data to the system, potentially tricking the network into making incorrect policy or traffic decisions. This could lead to service disruption or unauthorized manipulation of subscriber data within a 5G core network.

Technologies: free5GC NEF, github.com/free5gc/nef (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44320 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44320 being exploited in the wild.
How severe is CVE-2026-44320?: High severity, with a CVSS score of 7.3, published 27 May 2026.
Which products and versions are affected?: free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.
Is there a fix for CVE-2026-44320?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44320 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44320?: Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The free5GC NEF implementation mounts the 'nnef-callback' route group without any inbound OAuth2 or bearer-token authorization middleware. This vulnerability (CWE-306/CWE-862) allows an attacker to reach the SMF-callback handler by providing any arbitrary bearer token. The API layer deserializes the request body and dispatches it to business logic before performing identity verification. If an attacker can guess or obtain a valid 'NotifId', they can inject forged event notifications that mutate subscription states, affecting downstream Session Management Function (SMF) and User Plane Function (UPF) policy decisions. The route group is also exposed even if not explicitly declared in the runtime ServiceList.

Affected products

free5GC nef <= 1.2.3

Identifiers

CVE-2026-44320
GHSA-wqfh-gq79-j8mf
GO-2026-5717

Timeline

2026-03-11: other: Vulnerability validated in lab environment
2026-05-07: disclosed: Initial disclosure to vendor/GitHub
2026-05-08: advisory: GitHub Advisory published
2026-05-27: other: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.