CVE-2026-44315: free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

Synopsis

This is an authentication bypass vulnerability in the free5GC open-source 5G core network implementation, specifically in the NEF (Network Exposure Function) component's 3gpp-pfd-management API. The API is reachable over the network with no valid credentials required; any arbitrary or forged bearer token is accepted, meaning no real authentication barrier exists. A successful attacker can create, read, and delete PFD (Packet Flow Description) transaction state, disrupting network policy enforcement and exposing configuration data. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the NEF Service-Based Interface (SBI) port over the network; no local or physical access is needed.

• AuthenticationNot required

  No valid credentials are needed; the API accepts any bearer token value, including a fabricated or empty string, so there is no real authentication barrier.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or operator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental dependencies are involved.

Blast Radius

• Reads PFD transaction state, which can expose packet-flow policy configurations intended to be internal to the operator network.
• Creates arbitrary PFD transactions, injecting forged packet-flow rules that alter how traffic is classified and routed for 5G subscribers.
• Deletes existing PFD transactions, removing legitimate traffic-steering rules and disrupting application-aware policy enforcement.
• Crashes or destabilizes the NEF service by flooding or corrupting transaction state, causing denial of service for dependent 5G core functions.