CVE-2026-44320: free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

Synopsis

This is an authentication bypass vulnerability in the NEF (Network Exposure Function) component of free5GC, an open-source 5G core network implementation. The nnef-callback route group is mounted without any OAuth2 or bearer-token authorization middleware, meaning any request carrying an arbitrary or forged Authorization header bypasses the auth boundary and reaches SMF-callback business logic. An attacker who can guess or obtain a valid NotifId can forge callback requests to read, modify, or disrupt real subscription state. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The nnef-callback route group is exposed over the network, so an attacker must be able to send HTTP requests to the NEF service endpoint to reach the vulnerable handler.

• AuthenticationNot required

  No OAuth2 or bearer-token validation is enforced on the nnef-callback route group, so any request with an arbitrary or forged Authorization header is accepted without credential verification.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends forged callback requests directly to the NEF service.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker can reach the service; the only attacker-controlled variable is guessing or obtaining a valid NotifId to act on real subscription state.

Blast Radius

• Reads subscription state associated with valid NotifIds, exposing 5G subscriber session data stored in the NEF processing path.
• Modifies active subscription state by injecting forged SMF-callback content, altering session or policy records for affected subscribers.
• Disrupts NEF business logic by replaying or corrupting callback dispatches, degrading service continuity for subscriptions handled by the affected route group.
• Reaches the vulnerable handler even when the runtime ServiceList does not declare the nnef-callback route, widening the exposed surface beyond what the operator may expect.