CVE-2026-44329

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44329
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44329.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44329
Aliases
Published
2026-05-27T15:38:35.080Z
Modified
2026-07-08T08:13:29.502643218Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H CVSS Calculator
Summary
free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
Details

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44329.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306",
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/free5gc/free5gc

Affected ranges

Type
GIT
Repo
https://github.com/free5gc/free5gc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8b0f4445fc931638fb624463ce3572a203517679
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/free5gc/smf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e23ce97565f285eb99eed153743c62bf4c767c6e
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.2
v3.*
v3.0.5
v3.0.6
v3.0.7
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.2.0
v4.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44329.json"