Junglewise Threat Intelligence

CVE-2026-8743: Open5GS improper authorization in AMF and MME UE context lookup

CVE-2026-8743 · Severity: medium · CVSS 6.3 · Published 2026-05-17

Technologies: Open5GS. Vendors: Open5GS.

Executive brief

Open5GS is an open-source implementation of 5G and LTE mobile core networks. A vulnerability in its Access and Mobility Management Function (AMF) allows a malicious base station (gNB) to hijack data traffic belonging to users on other base stations. By sending forged messages, an attacker can redirect a victim's incoming data to their own equipment, leading to unauthorized data interception and service disruption.

Technical details

An improper authorization vulnerability exists in the AMF and MME components of Open5GS up to version 2.7.6. The function 'ran_ue_find_by_amf_ue_ngap_id' in 'src/amf/context.c' performs a global lookup of User Equipment (UE) contexts using only the AMF-UE-NGAP-ID, without verifying if the requesting base station (gNB/eNB) actually owns that context. A remote attacker operating a compromised or malicious base station can send a forged 'PDUSessionResourceSetupResponse' containing a victim's ID and attacker-controlled GTP-U tunnel endpoints. This causes the AMF to update the Session Management Function (SMF) and User Plane Function (UPF), effectively redirecting the victim's downlink traffic to the attacker. The issue has been addressed in commit 5746b85 by implementing common helpers to validate RAN ownership for UE-associated messages.

Affected products

  • Open5GS Open5GS up to 2.7.6

Timeline

  • 2026-05-10: patched: Fix merged into main branch via PR 4553
  • 2026-05-17: disclosed: Vulnerability published and CVE assigned

References

Related threats