Is CVE-2026-44329 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44329 being exploited in the wild.

How severe is CVE-2026-44329?

Critical severity, with a CVSS score of 10, published 27 May 2026.

Which products and versions are affected?

free5GC Smf < 1.4.3, <= v4.2.1; github.com/free5gc/smf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

Is there a fix for CVE-2026-44329?

Yes. github.com/free5gc/smf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44329 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44329?

Check whether you run free5GC Smf or github.com/free5gc/smf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44329: free5GC SMF missing authentication in UPI management interface

Q: Which products and versions are affected?

free5GC Smf < 1.4.3, <= v4.2.1; github.com/free5gc/smf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.

Q: Is there a fix for CVE-2026-44329?

Yes. github.com/free5gc/smf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44329 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-44329?

Check whether you run free5GC Smf or github.com/free5gc/smf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44329 · Severity: critical · CVSS 10 · Published 2026-05-27

The Session Management Function (SMF) in free5GC, which manages user data sessions in a 5G network, contains a security flaw where its topology management interface does not require authentication. This allows any attacker with network access to the management interface to view, modify, or delete the network's internal structure. Such an exploit could lead to the redirection of user traffic to malicious servers or a complete disruption of mobile data services.

Technologies: free5GC Smf, github.com/free5gc/smf (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44329 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44329 being exploited in the wild.
How severe is CVE-2026-44329?: Critical severity, with a CVSS score of 10, published 27 May 2026.
Which products and versions are affected?: free5GC Smf < 1.4.3, <= v4.2.1; github.com/free5gc/smf (Go) < 1.4.3, SEMVER:introduced=0,fixed=1.4.3.
Is there a fix for CVE-2026-44329?: Yes. github.com/free5gc/smf (Go): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44329 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44329?: Check whether you run free5GC Smf or github.com/free5gc/smf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/free5gc/smf (Go): upgrade to 1.4.3 or later
```
go get github.com/free5gc/smf@v1.4.3
```

Technical details

The Session Management Function (SMF) in free5GC fails to apply OAuth2/bearer-token authentication middleware to the User Plane Information (UPI) route group. While other sibling route groups like 'nsmf-oam' are protected, the UPI group is mounted without these security checks in 'NFs/smf/internal/sbi/server.go'. An unauthenticated attacker can reach the Service Based Interface (SBI) and interact with endpoints such as '/upi/v1/upNodesLinks' via GET, POST, and DELETE methods. This allows for unauthorized disclosure of the User Plane topology, injection of malicious User Plane Function (UPF) nodes to hijack PDU sessions, or deletion of legitimate nodes to cause a denial of service. The vulnerability is fixed in version 1.4.3.

Affected products

free5GC smf < 1.4.3

Identifiers

CVE-2026-44329
GHSA-3258-qmv8-frp3
GO-2026-4995

Timeline

2026-03-13: other: Vulnerability validated in Docker lab environment
2026-05-08: advisory: GitHub Advisory published
2026-05-27: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.