CVE intelligence and bounded remediation

CVE-2026-44330 — free5GC is an open-source implementation of the 5G core network

Critical CVSS 10

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2.

Severity
Critical
CVSS
10 (3.1)
Published
2026-05-27
CISA KEV
Not currently listed
Ecosystem
software/application
Weaknesses
CWE-863

Affected products

  • free5gc / free5gc

Matched remediation archetype

Authorization bypass, IDOR, and cross-tenant access

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Map object and action authorization checks across API, UI, batch, import/export, and background-job paths.
  • Identify tenant, ownership, role, and policy boundaries for affected resources and administrative operations.
  • Use synthetic fixtures to compare intended access matrices without accessing another user's real data.

Remediate safely

  • Enforce server-side authorization at each resource access and state transition using the authenticated principal and trusted tenant context.
  • Scope data queries by tenant and ownership; treat client-supplied identifiers, roles, and policy claims as untrusted.
  • Add deny-by-default policy tests for horizontal and vertical access across every affected transport.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.