Executive brief
free5GC's Network Repository Function (NRF) is a critical service discovery component in 5G networks that stores and distributes information about network functions to other services. The NRF accepts network function registration requests without validating required fields, allowing attackers to register fake network functions with arbitrary IP addresses. Legitimate network functions automatically discover and route traffic to these attacker-controlled endpoints, enabling traffic interception, credential theft, and service denial across the entire 5G network mesh.
Technical details
The vulnerability exists in free5GC NRF's PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} endpoint (RegisterNFInstance handler), which accepts NF profile registration requests without enforcing 3GPP TS 29.510 specification constraints. The vulnerable component has no validation for: (1) nfInstanceId UUID v4 format, (2) nfStatus enum constraints (must be REGISTERED/SUSPENDED/UNDISCOVERABLE), (3) heartBeatTimer range [1-3600], (4) mandatory nfProfile field presence, or (5) IP endpoint integrity in nfServices.ipEndPoints. MongoDB's NfProfile collection lacks JSON schema validation. Attackers with SBI network access (no authentication required in default config) can register fake network functions with attacker-controlled service endpoints; legitimate NFs discover these via NFDiscover and automatically route control-plane traffic to attacker IPs, enabling traffic interception, OAuth2 credential harvesting, and denial of service affecting AMF, SMF, AUSF, UDM, PCF, and NSSF. Fix: add UUID/enum/range/required-field validation to RegisterNFInstance; return HTTP 400 on validation failure. Patches available in free5gc v4.2.2+ and nrf v1.4.5+.
Affected products
- free5gc free5gc < 4.2.2
- free5gc nrf < 1.4.5
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-08-28: advisory: Advisory updated with additional details
- 2026: patched: Patches released in free5gc v4.2.2+ and nrf v1.4.5+