Executive brief
The free5GC Network Exposure Function (NEF) contains a security flaw where its traffic influence interface is completely unprotected. This component is responsible for allowing external applications to influence how network traffic is routed. An attacker can exploit this to redirect mobile user traffic to malicious servers, intercept data, or disrupt network services for all users.
Technical details
The free5GC Network Exposure Function (NEF) fails to implement inbound OAuth2 or bearer-token authorization for the '3gpp-traffic-influence' API (CWE-306, CWE-862). The route group is mounted without authentication middleware in 'internal/sbi/server.go', making it reachable even if the service is not declared in the configuration's ServiceList. A network-reachable attacker can perform CRUD operations on traffic-influence subscriptions by providing no Authorization header or a forged token. This allows for unauthorized state changes on traffic-steering policy objects, potentially affecting 'AnyUeInd' (any User Equipment) traffic steering. A fix is available in the upstream repository.
Affected products
- free5GC nef <= 1.2.3
Timeline
- 2026-03-11: other: Vulnerability validated in lab environment
- 2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
- 2026-05-08: advisory: GitHub Advisory published (GHSA-3p28-73q7-45xp)
- 2026-05-27: other: CVE published to NVD