Executive brief
The Network Exposure Function (NEF) in free5GC, which facilitates secure communication between the core network and external applications, contains a security flaw in its PFD management interface. An attacker can bypass security checks to view sensitive traffic-classification policies or manipulate notification settings, potentially leading to data leaks or service disruptions. This vulnerability allows unauthorized users to perform administrative actions that should be restricted to trusted network components.
Technical details
The free5GC NEF implementation mounts the 'nnef-pfdmanagement' route group without any inbound OAuth2 or bearer-token authorization middleware. This allows a network-reachable attacker to use forged or arbitrary bearer tokens to access SBI (Service Based Interface) endpoints. Specifically, attackers can read PFD application data (leaking URL regex patterns and app IDs), create malicious change-notification subscriptions to trigger outbound HTTP requests, or delete legitimate subscriptions to disrupt PFD update propagation. The root cause is the absence of authentication checks in the server's route registration for the PFDF API group. A fix is available in the upstream NEF repository.
Affected products
- free5GC nef <= 1.2.3
Timeline
- 2026-03-11: other: Vulnerability validated in lab environment
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: advisory: NVD published CVE-2026-44330