Is CVE-2026-55068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55068 being exploited in the wild.

How severe is CVE-2026-55068?

Critical severity, with a CVSS score of 4, published 28 August 2026.

Which products and versions are affected?

free5GC < 4.2.2; free5GC NRF < 1.4.5; github.com/free5gc/free5gc (Go) < 4.2.2, SEMVER:introduced=0,fixed=4.2.2, SEMVER:introduced=0,fixed=4.2.2+incompatible.

Is there a fix for CVE-2026-55068?

Yes. github.com/free5gc/free5gc (Go): upgrade to 4.2.2, 4.2.2+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55068 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55068?

Check whether you run free5GC, free5GC NRF or github.com/free5gc/free5gc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55068: free5GC NRF input validation bypass in NF profile registration

Q: Which products and versions are affected?

free5GC < 4.2.2; free5GC NRF < 1.4.5; github.com/free5gc/free5gc (Go) < 4.2.2, SEMVER:introduced=0,fixed=4.2.2, SEMVER:introduced=0,fixed=4.2.2+incompatible.

Q: Is there a fix for CVE-2026-55068?

Yes. github.com/free5gc/free5gc (Go): upgrade to 4.2.2, 4.2.2+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55068 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-55068?

Check whether you run free5GC, free5GC NRF or github.com/free5gc/free5gc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55068 · Severity: critical · CVSS 4 · Published 2026-08-28

free5GC's Network Repository Function (NRF) is a critical service discovery component in 5G networks that stores and distributes information about network functions to other services. The NRF accepts network function registration requests without validating required fields, allowing attackers to register fake network functions with arbitrary IP addresses. Legitimate network functions automatically discover and route traffic to these attacker-controlled endpoints, enabling traffic interception, credential theft, and service denial across the entire 5G network mesh.

Technologies: free5GC, free5GC NRF, github.com/free5gc/free5gc (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-55068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55068 being exploited in the wild.
How severe is CVE-2026-55068?: Critical severity, with a CVSS score of 4, published 28 August 2026.
Which products and versions are affected?: free5GC < 4.2.2; free5GC NRF < 1.4.5; github.com/free5gc/free5gc (Go) < 4.2.2, SEMVER:introduced=0,fixed=4.2.2, SEMVER:introduced=0,fixed=4.2.2+incompatible.
Is there a fix for CVE-2026-55068?: Yes. github.com/free5gc/free5gc (Go): upgrade to 4.2.2, 4.2.2+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55068 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55068?: Check whether you run free5GC, free5GC NRF or github.com/free5gc/free5gc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/free5gc/free5gc (Go): upgrade to 4.2.2, 4.2.2+incompatible or later
```
go get github.com/free5gc/free5gc@v4.2.2+incompatible
```

Technical details

The vulnerability exists in free5GC NRF's PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} endpoint (RegisterNFInstance handler), which accepts NF profile registration requests without enforcing 3GPP TS 29.510 specification constraints. The vulnerable component has no validation for: (1) nfInstanceId UUID v4 format, (2) nfStatus enum constraints (must be REGISTERED/SUSPENDED/UNDISCOVERABLE), (3) heartBeatTimer range [1-3600], (4) mandatory nfProfile field presence, or (5) IP endpoint integrity in nfServices.ipEndPoints. MongoDB's NfProfile collection lacks JSON schema validation. Attackers with SBI network access (no authentication required in default config) can register fake network functions with attacker-controlled service endpoints; legitimate NFs discover these via NFDiscover and automatically route control-plane traffic to attacker IPs, enabling traffic interception, OAuth2 credential harvesting, and denial of service affecting AMF, SMF, AUSF, UDM, PCF, and NSSF. Fix: add UUID/enum/range/required-field validation to RegisterNFInstance; return HTTP 400 on validation failure. Patches available in free5gc v4.2.2+ and nrf v1.4.5+.

Affected products

free5gc free5gc < 4.2.2
free5gc nrf < 1.4.5

Identifiers

CVE-2026-55068
GHSA-x8mj-6p3q-g5pp
GO-2026-6316

Timeline

2026-06-22: disclosed: Published to GitHub Advisory Database
2026-08-28: advisory: Advisory updated with additional details
2026: patched: Patches released in free5gc v4.2.2+ and nrf v1.4.5+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.