Executive brief
The free5GC Network Exposure Function (NEF) contains a security flaw where certain communication channels used for receiving notifications are not properly secured. This allows an unauthorized person to send fake data to the system, potentially tricking the network into making incorrect policy or traffic decisions. This could lead to service disruption or unauthorized manipulation of subscriber data within a 5G core network.
Technical details
The free5GC NEF implementation mounts the 'nnef-callback' route group without any inbound OAuth2 or bearer-token authorization middleware. This vulnerability (CWE-306/CWE-862) allows an attacker to reach the SMF-callback handler by providing any arbitrary bearer token. The API layer deserializes the request body and dispatches it to business logic before performing identity verification. If an attacker can guess or obtain a valid 'NotifId', they can inject forged event notifications that mutate subscription states, affecting downstream Session Management Function (SMF) and User Plane Function (UPF) policy decisions. The route group is also exposed even if not explicitly declared in the runtime ServiceList.
Affected products
- free5GC nef <= 1.2.3
Timeline
- 2026-03-11: other: Vulnerability validated in lab environment
- 2026-05-07: disclosed: Initial disclosure to vendor/GitHub
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD publication