DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55068: CVE-2026-55068: Network Function Registration Poisoning in free5GC NRF

#security #cve #cybersecurity

CVE-2026-55068: Network Function Registration Poisoning in free5GC NRF

Vulnerability ID: CVE-2026-55068
CVSS Score: 9.3
Published: 2026-08-28

Improper input validation in the free5GC Network Repository Function (NRF) enables attackers with Service-Based Interface (SBI) access to register poisoned Network Function (NF) profiles, facilitating control-plane redirection and credential sniffing.

TL;DR

Unauthenticated remote attackers can register malformed NF profiles to redirect legitimate 5G control-plane signaling to attacker-controlled endpoints.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20 (Improper Input Validation)
  • Attack Vector: Network (SBI access)
  • CVSS v4.0: 9.3
  • Impact: Control-Plane Redirect / Information Disclosure / Denial of Service
  • Exploit Status: Proof-of-Concept Available
  • KEV Status: Not Listed

Affected Systems

  • free5GC Core v4.2.2 and earlier
  • free5GC NRF Component v1.4.4 and earlier
  • free5GC: <= 4.2.2 (Fixed in: 4.2.3)
  • NRF (Network Repository Function): <= 1.4.4 (Fixed in: 1.4.5)

Code Analysis

Commit: bda0cf7

fix: add concrete validation for nfProfile create and patch

Commit: fcd3cfa

Merge pull request #90 from Zach1113/fix/nf-profile-validation-on-create-and-patch

Mitigation Strategies

  • Upgrade the free5GC core platform to version v4.2.3 or higher.
  • Isolate the NRF microservice and update its binary component to version v1.4.5 or higher.
  • Implement mutual TLS (mTLS) authentication across the Service-Based Interface (SBI) to verify the identities of registering NFs.
  • Utilize Network Policies (Kubernetes NetPol) to strictly limit network communication to the NRF REST port (typically TCP 8000).

Remediation Steps:

  1. Stop the running free5GC NRF process or tear down its container.
  2. Update the free5GC configuration and pull NRF component code from version 1.4.5 or later.
  3. Recompile the NRF binary using Go v1.21+ to incorporate the newly defined nf_profile_validation.go module.
  4. Verify the validation changes by attempting to send a malformed PUT profile with a non-UUID instance identifier and confirming that the server responds with an HTTP 400 Bad Request.

References

Read the full report for CVE-2026-55068 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)