CVE-2026-44326: free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

Synopsis

This is an authentication bypass vulnerability in free5GC's Network Exposure Function (NEF). The 3gpp-traffic-influence API is mounted without any OAuth2 or bearer-token authorization check, meaning a remote attacker who can reach the NEF Service-Based Interface (SBI) port over the network can call the API with no credentials or with an obviously forged token and be accepted. Successful exploitation lets the attacker read, create, modify, and delete traffic-influence subscriptions, including those that steer traffic for all UEs on the network, and can crash the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the NEF Service-Based Interface port over the network; the vulnerable API is exposed as a standard HTTP endpoint with no additional transport barrier.

• AuthenticationNot required

  No credentials are needed: the API accepts requests with no Authorization header at all, or with an arbitrary forged bearer token value.

• Victim interactionNot required

  Exploitation is fully server-side; no user action or social engineering is required.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring only a reachable NEF port and a valid API request shape; no race conditions or special environmental state apply.

Blast Radius

• Reads all existing traffic-influence subscriptions, exposing traffic-steering policy details and UE targeting configurations.
• Creates or modifies subscriptions, including AnyUeInd=true entries that redirect or manipulate traffic for every UE on the network.
• Deletes traffic-influence subscriptions, silently removing legitimate traffic-steering policies and disrupting network routing behavior.
• Crashes the NEF service through malformed or resource-exhausting subscription operations, taking the Network Exposure Function offline.