# CVE-2026-44326: free5GC NEF missing authentication in 3gpp-traffic-influence API

Source: https://junglewise.ai/threats/cve-2026-44326-free5gc-nef-missing-authentication-in-3gpp-traffic-influence-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44326 · Severity: critical · CVSS 9.4 · Published 2026-05-27

The free5GC Network Exposure Function (NEF) contains a security flaw where its traffic influence interface is completely unprotected. This component is responsible for allowing external applications to influence how network traffic is routed. An attacker can exploit this to redirect mobile user traffic to malicious servers, intercept data, or disrupt network services for all users.

Technologies: [free5GC NEF](https://junglewise.ai/threats/technologies/nef), [github.com/free5gc/nef (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-nef). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44326 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44326 being exploited in the wild.

**How severe is CVE-2026-44326?** Critical severity, with a CVSS score of 9.4, published 27 May 2026.

**Which products and versions are affected?** free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

**Is there a fix for CVE-2026-44326?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44326 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44326?** Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The free5GC Network Exposure Function (NEF) fails to implement inbound OAuth2 or bearer-token authorization for the '3gpp-traffic-influence' API (CWE-306, CWE-862). The route group is mounted without authentication middleware in 'internal/sbi/server.go', making it reachable even if the service is not declared in the configuration's ServiceList. A network-reachable attacker can perform CRUD operations on traffic-influence subscriptions by providing no Authorization header or a forged token. This allows for unauthorized state changes on traffic-steering policy objects, potentially affecting 'AnyUeInd' (any User Equipment) traffic steering. A fix is available in the upstream repository.

## Affected products

- free5GC nef <= 1.2.3

## Identifiers

- CVE-2026-44326
- GHSA-3p28-73q7-45xp
- GO-2026-5093

## Timeline

- 2026-03-11: other: Vulnerability validated in lab environment
- 2026-05-07: disclosed: Advisory published to free5gc/free5gc repository
- 2026-05-08: advisory: GitHub Advisory published (GHSA-3p28-73q7-45xp)
- 2026-05-27: other: CVE published to NVD

## References

- [https://api.github.com/users/LinZiyuu](https://api.github.com/users/LinZiyuu)
- [https://github.com/LinZiyuu](https://github.com/LinZiyuu)
- [https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D](https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D)
- [https://api.github.com/users/LinZiyuu/repos](https://api.github.com/users/LinZiyuu/repos)
- [https://avatars.githubusercontent.com/u/104151270?v=4](https://avatars.githubusercontent.com/u/104151270?v=4)
- [https://api.github.com/users/LinZiyuu/events%7B/privacy%7D](https://api.github.com/users/LinZiyuu/events%7B/privacy%7D)

## Related threats

- [free5GC NEF authentication bypass in nnef-pfdmanagement API](https://junglewise.ai/threats/cve-2026-44330-free5gc-nef-authentication-bypass-in-nnef-pfdmanagement-api)
- [free5GC NEF missing authentication in OAM route group](https://junglewise.ai/threats/cve-2026-44327-free5gc-nef-missing-authentication-in-oam-route-group)
- [free5GC NEF NULL pointer dereference in PFD management handler](https://junglewise.ai/threats/cve-2026-44322-free5gc-nef-null-pointer-dereference-in-pfd-management-handler)
- [free5GC NEF missing authentication in nnef-callback route group](https://junglewise.ai/threats/cve-2026-44320-free5gc-nef-missing-authentication-in-nnef-callback-route-group)
- [free5GC NEF denial of service via unreachable notification URI](https://junglewise.ai/threats/cve-2026-44319-free5gc-nef-denial-of-service-via-unreachable-notification-uri)