CVE-2026-44327: free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

Synopsis

This is an authentication bypass in the Network Exposure Function (NEF) component of free5GC, an open-source 5G core network implementation. An attacker who can reach the NEF Service Based Interface (SBI) over the network can send requests to the OAM route group with no Authorization header and receive a valid 200 OK response, because the entire nnef-oam route group is mounted without OAuth2 or bearer-token middleware. Successful exploitation gives an unauthenticated attacker direct access to OAM operations, with the structural defect meaning any future OAM handler added to the group inherits the missing auth boundary by default, enabling data disclosure, data tampering, and service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment the upstream fix is published at version 4.2.2.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the NEF SBI port over the network; no local or physical access is needed, and no prior foothold is required.

• AuthenticationNot required

  No Authorization header, bearer token, or OAuth2 credential of any kind is needed; the OAM route group accepts requests with a completely absent auth header.

• Victim interactionNot required

  Exploitation is fully server-side; no user action, click, or social-engineering step is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free: sending a plain HTTP request to the OAM route is sufficient, with no race conditions, memory layout dependencies, or environmental prerequisites.

Blast Radius

• Reads any data returned by current or future OAM handlers, including operational and administrative state exposed over the unauthenticated route group.
• Modifies network exposure function configuration or operational state via any OAM write handler added to the route group in current or future code.
• Crashes or degrades NEF availability by invoking OAM operations that affect service state, disrupting 5G core network exposure services for connected consumers.
• Every new OAM handler merged into the route group inherits the missing auth boundary by default, expanding the attackable surface with each future code change.