# CVE-2026-44327: free5GC NEF missing authentication in OAM route group

Source: https://junglewise.ai/threats/cve-2026-44327-free5gc-nef-missing-authentication-in-oam-route-group  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44327 · Severity: critical · CVSS 10 · Published 2026-05-27

The Network Exposure Function (NEF) in the free5GC 5G core framework fails to require authentication for its Operations, Administration, and Maintenance (OAM) interface. This component is responsible for exposing network capabilities to external applications. An attacker with network access could interact with administrative functions without a password or security token, potentially leading to unauthorized monitoring or control of the 5G network infrastructure.

Technologies: [free5GC NEF](https://junglewise.ai/threats/technologies/nef), [github.com/free5gc/nef (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-nef). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44327 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44327 being exploited in the wild.

**How severe is CVE-2026-44327?** Critical severity, with a CVSS score of 10, published 27 May 2026.

**Which products and versions are affected?** free5GC NEF <= 1.2.3, <= 4.2.1; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

**Is there a fix for CVE-2026-44327?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44327 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44327?** Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The free5GC Network Exposure Function (NEF) contains a structural authentication bypass in its Service Based Interface (SBI). The `nnef-oam` route group is mounted without the necessary OAuth2/bearer-token middleware, even when OAuth2 is globally enabled. This allows a remote, unauthenticated attacker to reach OAM handlers by omitting the Authorization header. While the current OAM handler is a stub, the vulnerability is route-group-scoped, meaning any future administrative or operational functions added to this group will be exposed without authentication by default. This has been assigned CWE-306 (Missing Authentication) and CWE-862 (Missing Authorization).

## Affected products

- free5GC nef <= 1.2.3

## Identifiers

- CVE-2026-44327
- GHSA-cmpj-2x3g-m7g3
- GO-2026-5326

## Timeline

- 2026-03-11: other: Vulnerability validated in Docker lab environment
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD publication date

## References

- [https://api.github.com/users/LinZiyuu](https://api.github.com/users/LinZiyuu)
- [https://github.com/LinZiyuu](https://github.com/LinZiyuu)
- [https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D](https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D)
- [https://api.github.com/users/LinZiyuu/repos](https://api.github.com/users/LinZiyuu/repos)
- [https://avatars.githubusercontent.com/u/104151270?v=4](https://avatars.githubusercontent.com/u/104151270?v=4)
- [https://api.github.com/users/LinZiyuu/events%7B/privacy%7D](https://api.github.com/users/LinZiyuu/events%7B/privacy%7D)

## Related threats

- [free5GC NEF authentication bypass in nnef-pfdmanagement API](https://junglewise.ai/threats/cve-2026-44330-free5gc-nef-authentication-bypass-in-nnef-pfdmanagement-api)
- [free5GC NEF missing authentication in 3gpp-traffic-influence API](https://junglewise.ai/threats/cve-2026-44326-free5gc-nef-missing-authentication-in-3gpp-traffic-influence-api)
- [free5GC NEF NULL pointer dereference in PFD management handler](https://junglewise.ai/threats/cve-2026-44322-free5gc-nef-null-pointer-dereference-in-pfd-management-handler)
- [free5GC NEF missing authentication in nnef-callback route group](https://junglewise.ai/threats/cve-2026-44320-free5gc-nef-missing-authentication-in-nnef-callback-route-group)
- [free5GC NEF denial of service via unreachable notification URI](https://junglewise.ai/threats/cve-2026-44319-free5gc-nef-denial-of-service-via-unreachable-notification-uri)