CVE-2026-42083: free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI

Synopsis

This is an authentication bypass vulnerability in free5GC, an open-source 5G core network implementation, affecting the PCF (Policy Control Function) component. The Npcf_SMPolicyControl route group is registered without the RouterAuthorizationCheck middleware, meaning any unauthenticated caller on the network can reach SM policy endpoints that should require a valid OAuth token. Successful exploitation exposes subscriber SUPI (a permanent device identifier) and allows limited modification of session management policy data. HarborGuard tracks the upstream advisory for this CVE as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP endpoints are exposed over the network, so an attacker must be able to send HTTP requests to the PCF service interface.

• AuthenticationNot required

  No OAuth token or any other credential is required; the missing middleware means unauthenticated requests reach business logic directly.

• Victim interactionNot required

  The attacker sends requests directly to the API; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the attacker simply omits an authorization header on a standard HTTP request to the affected endpoints.

Blast Radius

• Reads subscriber SUPI values (permanent device identifiers) from SM policy responses, enabling subscriber tracking and identity correlation.
• Writes limited changes to session management policy data on affected endpoints, potentially altering QoS or charging rules for active subscriber sessions.
• Confidentiality impact is high; integrity impact is limited to the SM policy resource and does not extend to broader core-network configuration.
• Availability is not directly affected; the service continues running after exploitation.