Is CVE-2026-44330 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44330 being exploited in the wild.

How severe is CVE-2026-44330?

Critical severity, with a CVSS score of 10, published 27 May 2026.

Which products and versions are affected?

free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Is there a fix for CVE-2026-44330?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44330 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44330?

Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44330: free5GC NEF authentication bypass in nnef-pfdmanagement API

Q: Which products and versions are affected?

free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.

Q: Is there a fix for CVE-2026-44330?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44330 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-44330?

Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44330 · Severity: critical · CVSS 10 · Published 2026-05-27

The Network Exposure Function (NEF) in free5GC, which facilitates secure communication between the core network and external applications, contains a security flaw in its PFD management interface. An attacker can bypass security checks to view sensitive traffic-classification policies or manipulate notification settings, potentially leading to data leaks or service disruptions. This vulnerability allows unauthorized users to perform administrative actions that should be restricted to trusted network components.

Technologies: free5GC NEF, github.com/free5gc/nef (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-44330 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44330 being exploited in the wild.
How severe is CVE-2026-44330?: Critical severity, with a CVSS score of 10, published 27 May 2026.
Which products and versions are affected?: free5GC NEF < 4.2.2, <= 1.2.3; github.com/free5gc/nef (Go) <= 1.2.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.3.
Is there a fix for CVE-2026-44330?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44330 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44330?: Check whether you run free5GC NEF or github.com/free5gc/nef (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The free5GC NEF implementation mounts the 'nnef-pfdmanagement' route group without any inbound OAuth2 or bearer-token authorization middleware. This allows a network-reachable attacker to use forged or arbitrary bearer tokens to access SBI (Service Based Interface) endpoints. Specifically, attackers can read PFD application data (leaking URL regex patterns and app IDs), create malicious change-notification subscriptions to trigger outbound HTTP requests, or delete legitimate subscriptions to disrupt PFD update propagation. The root cause is the absence of authentication checks in the server's route registration for the PFDF API group. A fix is available in the upstream NEF repository.

Affected products

free5GC nef <= 1.2.3

Identifiers

CVE-2026-44330
GHSA-rwww-x45w-p52w
GO-2026-5642

Timeline

2026-03-11: other: Vulnerability validated in lab environment
2026-05-08: advisory: GitHub Advisory published
2026-05-27: advisory: NVD published CVE-2026-44330

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.