Is CVE-2026-44326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44326 being exploited in the wild.

How severe is CVE-2026-44326?

Critical severity, with a CVSS score of 9.4, published 27 May 2026.

Which products and versions are affected?

free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Is there a fix for CVE-2026-44326?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44326 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44326?

Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44326: free5GC NEF missing authentication in 3gpp-traffic-influence API

Q: Which products and versions are affected?

free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Q: Is there a fix for CVE-2026-44326?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44326 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-44326?

Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44326 · Severity: critical · CVSS 9.4 · Published 2026-05-27

The free5GC Network Exposure Function (NEF) contains a security flaw where its traffic influence interface is completely unprotected. This component is responsible for allowing external applications to influence how network traffic is routed. An attacker can exploit this to redirect mobile user traffic to malicious servers, intercept data, or disrupt network services for all users.

Technologies: free5GC NEF, github.com/free5gc/nef (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44326 being exploited in the wild.
How severe is CVE-2026-44326?: Critical severity, with a CVSS score of 9.4, published 27 May 2026.
Which products and versions are affected?: free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.
Is there a fix for CVE-2026-44326?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44326 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44326?: Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The free5GC Network Exposure Function (NEF) fails to implement inbound OAuth2 or bearer-token authorization for the '3gpp-traffic-influence' API (CWE-306, CWE-862). The route group is mounted without authentication middleware in 'internal/sbi/server.go', making it reachable even if the service is not declared in the configuration's ServiceList. A network-reachable attacker can perform CRUD operations on traffic-influence subscriptions by providing no Authorization header or a forged token. This allows for unauthorized state changes on traffic-steering policy objects, potentially affecting 'AnyUeInd' (any User Equipment) traffic steering. A fix is available in the upstream repository.

Affected products

free5GC nef <= 1.2.3

Identifiers

CVE-2026-44326
GHSA-3p28-73q7-45xp
GO-2026-5093

Timeline

2026-03-11: other: Vulnerability validated in lab environment
2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
2026-05-08: advisory: GitHub Advisory published (GHSA-3p28-73q7-45xp)
2026-05-27: other: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.