CVE Explorer
CVE-2026-44315
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token). The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think t
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"free5gc","vendor":"free5gc","versions":[{"status":"affected","version":"< 4.2.2"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/free5gc/free5gc/issues/858","tags":["x_refsource_MISC"],"url":"https://github.com/free5gc/free5gc/issues/858"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/cna/references/1
{"name":"https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/adp/0/references/0
{"name":"https://github.com/free5gc/nef/pull/23","tags":["x_refsource_MISC"],"url":"https://github.com/free5gc/nef/pull/23"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bbb417cb7da7531b6567cbf851f1a7cce95638a86f24d35eec7f1b14cb427cab · sha256:a48eddc2c1122394… · /containers/cna/references/2
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.