Improper input validation in free5gc
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| free5gc | free5gc | before 4.2.3 | 4.2.3 | Patch available | CNA |
| — | github.com/free5gc/free5gc (Go) | before 4.2.2 | 4.2.2 | Patch available | GHSA-x8mj-6p3q-g5pp |
- free5gc Vendorfree5gc Affected before 4.2.3 Fixed in 4.2.3 Patch available CNA
- github.com/free5gc/free5gc (Go) Vendor— Affected before 4.2.2 Fixed in 4.2.2 Patch available GHSA-x8mj-6p3q-g5pp
Remediation
- Fix · CNA free5gc (free5gc) Fixed in 4.2.3
- Fix · GHSA-x8mj-6p3q-g5pp github.com/free5gc/free5gc (Go) Fixed in 4.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55068
- 2026-10-03 Alias added: GHSA-x8mj-6p3q-g5pp
References
Other 8
- https://github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp
- https://github.com/free5gc/free5gc/issues/1056
- https://github.com/free5gc/nrf/pull/90
- https://github.com/free5gc/nrf/commit/bda0cf75be5556bb4c758c8b34710f3fe6bbe3ea
- https://github.com/free5gc/nrf/commit/fcd3cfaa27cc4dc17172ee0c4c3e0a3a696297c6
- https://github.com/free5gc/free5gc/releases/tag/v4.2.3
- https://github.com/free5gc/nrf/releases/tag/v1.4.5
- https://github.com/free5gc/free5gc
More free5gc vulnerabilities
- TI-2026-32298 Incorrect authorization in free5gc CVSS 3.1CRITICAL 10.0
- TI-2026-32297 free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CVSS 3.1CRITICAL 10.0
- TI-2026-32295 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CVSS 3.1CRITICAL 10.0
- TI-2025-39412 free5gc v4.1.0 and before is vulnerable to Buffer Overflow. CVSS 3.1CRITICAL 9.8
- TI-2026-32294 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4
- TI-2026-32283 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4
Sources
- CVE-2026-55068 · CVE Program
- CVE-2026-55068 · NVD
- FIRST EPSS
- GHSA-x8mj-6p3q-g5pp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences