# CVE-2026-44320: free5GC NEF missing authentication in nnef-callback route group

Source: https://junglewise.ai/threats/cve-2026-44320-free5gc-nef-missing-authentication-in-nnef-callback-route-group  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44320 · Severity: high · CVSS 7.3 · Published 2026-05-27

The free5GC Network Exposure Function (NEF) contains a security flaw where certain communication channels used for receiving notifications are not properly secured. This allows an unauthorized person to send fake data to the system, potentially tricking the network into making incorrect policy or traffic decisions. This could lead to service disruption or unauthorized manipulation of subscriber data within a 5G core network.

Technologies: [free5GC NEF](https://junglewise.ai/threats/technologies/nef), [github.com/free5gc/nef (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-nef). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44320 being exploited in the wild.

**How severe is CVE-2026-44320?** High severity, with a CVSS score of 7.3, published 27 May 2026.

**Which products and versions are affected?** free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

**Is there a fix for CVE-2026-44320?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44320 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44320?** Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The free5GC NEF implementation mounts the 'nnef-callback' route group without any inbound OAuth2 or bearer-token authorization middleware. This vulnerability (CWE-306/CWE-862) allows an attacker to reach the SMF-callback handler by providing any arbitrary bearer token. The API layer deserializes the request body and dispatches it to business logic before performing identity verification. If an attacker can guess or obtain a valid 'NotifId', they can inject forged event notifications that mutate subscription states, affecting downstream Session Management Function (SMF) and User Plane Function (UPF) policy decisions. The route group is also exposed even if not explicitly declared in the runtime ServiceList.

## Affected products

- free5GC nef <= 1.2.3

## Identifiers

- CVE-2026-44320
- GHSA-wqfh-gq79-j8mf
- GO-2026-5717

## Timeline

- 2026-03-11: other: Vulnerability validated in lab environment
- 2026-05-07: disclosed: Initial disclosure to vendor/GitHub
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD publication

## References

- [https://api.github.com/users/LinZiyuu](https://api.github.com/users/LinZiyuu)
- [https://github.com/LinZiyuu](https://github.com/LinZiyuu)
- [https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D](https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D)
- [https://api.github.com/users/LinZiyuu/repos](https://api.github.com/users/LinZiyuu/repos)
- [https://avatars.githubusercontent.com/u/104151270?v=4](https://avatars.githubusercontent.com/u/104151270?v=4)
- [https://api.github.com/users/LinZiyuu/events%7B/privacy%7D](https://api.github.com/users/LinZiyuu/events%7B/privacy%7D)

## Related threats

- [free5GC NEF authentication bypass in nnef-pfdmanagement API](https://junglewise.ai/threats/cve-2026-44330-free5gc-nef-authentication-bypass-in-nnef-pfdmanagement-api)
- [free5GC NEF missing authentication in OAM route group](https://junglewise.ai/threats/cve-2026-44327-free5gc-nef-missing-authentication-in-oam-route-group)
- [free5GC NEF missing authentication in 3gpp-traffic-influence API](https://junglewise.ai/threats/cve-2026-44326-free5gc-nef-missing-authentication-in-3gpp-traffic-influence-api)
- [free5GC NEF NULL pointer dereference in PFD management handler](https://junglewise.ai/threats/cve-2026-44322-free5gc-nef-null-pointer-dereference-in-pfd-management-handler)
- [free5GC NEF denial of service via unreachable notification URI](https://junglewise.ai/threats/cve-2026-44319-free5gc-nef-denial-of-service-via-unreachable-notification-uri)