CVE-2026-44328: free5gc Missing Auth

Description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2.

Is your site exposed to CVE-2026-44328?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS — Exploit Prediction

0.0030

Probability of exploitation

0.21%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-306 Missing Authentication

CWE-476 CWE-476

CWE-862 Missing Authorization

Affected Products

Vendor	Product	Versions
free5gc	free5gc	< 4.2.2

References

Advisories & Patches

https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr https://github.com/free5gc/smf/commit/b57bc48081c3d3a2f333d02eb78e4fd31a120deb https://github.com/free5gc/smf/pull/199 https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr

Exploits

https://github.com/free5gc/free5gc/issues/905 https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr https://github.com/free5gc/free5gc/issues/905 https://github.com/free5gc/free5gc/security/advisories/GHSA-p9mg-74mg-cwwr

Frequently Asked Questions

What is CVE-2026-44328? +

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2. It has a CVSS v3.1 base score of 8.2 (HIGH).

How severe is CVE-2026-44328? +

CVE-2026-44328 has a CVSS v3.1 score of 8.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0030, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-44328? +

CVE-2026-44328 affects products from free5gc, specifically: free5gc. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-44328? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-6369

An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to …

CVE-2026-9152

A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring …

CVE-2026-5749

Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT …

CVE-2026-6376

A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR …

CVE-2024-45483

A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical …

CVE-2026-10577

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not …

CVE-2026-44328