GHSA-3p28-73q7-45xp CRITICAL go/github.com/free5gc/nef

CVE: CVE-2026-44326

Summary

free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, patch, and delete traffic-influence subscriptions either with no Authorization header at all, or with a forged bearer token (e.g. Authorization: Bearer not-a-real-token). This includes creating AnyUeInd=true subscriptions intended to affect group / any-UE traffic steering. The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed.

This is the highest-impact NEF service exposure observed in the lab because it enables unauthenticated state changes on traffic-steering policy objects rather than read-only exposure.

Details

Validated against the NEF container in the official Docker compose lab.

• Source repo tag: v4.2.1
• Running Docker image: free5gc/nef:v4.2.0
• Runtime NEF commit: 5ce35eab
• Docker validation date: 2026-03-11

NEF advertises OAuth2 setting receive from NRF: true, and its ServiceList only declares nnef-pfdmanagement and nnef-oam. Despite that, the 3gpp-traffic-influence route group is mounted and reachable with no inbound auth middleware.

Code evidence (paths in free5gc/nef):

• Route group mounted without auth middleware: NFs/nef/internal/sbi/server.go:48
• CRUD routes exposed at /:afID/subscriptions and /:afID/subscriptions/:subID: NFs/nef/internal/sbi/api_ti.go:13
• POST allocates AF/subscription state and writes traffic-influence data: NFs/nef/internal/sbi/processor/ti.go:50
• PATCH looks up and updates the subscription, then calls UDR/PCF: NFs/nef/internal/sbi/processor/ti.go:279
• DELETE looks up and removes the subscription: NFs/nef/internal/sbi/processor/ti.go:355
• NEF context only exposes outbound token acquisition (GetTokenCtx); there is no inbound authorization path: `NFs/nef/internal/context/nef_c

📌 来源: GitHub-Advisory | 🆔 CVE-2026-44326 | 📅 2026-05-08