Quick answers
- Is CVE-2026-78158 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78158 being exploited in the wild.
- How severe is CVE-2026-78158?
- Medium severity, with a CVSS score of 6.3, published 24 August 2026.
- Which products and versions are affected?
- Open5GS 2.8.0.
- Is there a fix for CVE-2026-78158?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78158 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78158?
- Check whether you run Open5GS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper authorization / missing ownership validation flaw in the AMF's UEContextReleaseRequest message handler. The AMF fails to verify that a UEContextReleaseRequest originates from the NG-RAN node (base station) that actually owns/controls the target UE context; instead, it accepts the request from any associated gNB. An attacker controlling a second gNB association can send a UEContextReleaseRequest with another gNB's UE NGAP identifiers, causing the AMF to release that UE's context on the original gNB association. The vulnerability is network-reachable (requires NG-RAN/NGAP protocol access) and no authentication is bypassed—the flaw is in application-level context ownership authorization logic. A patch or update has not yet been released as of the advisory date.
Affected products
- Open5GS Open5GS 2.8.0
Timeline
- 2026-06-26: disclosed
- 2026-08-24: advisory