CVE-2026-44329: free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

Synopsis

This is an authentication bypass in free5GC's Session Management Function (SMF), specifically the UPI management interface. A remote attacker who can reach the SMF Service-Based Interface (SBI) over the network can issue GET, POST, and DELETE requests to UPI endpoints with no Authorization header, because the route group is registered without OAuth2 or bearer-token middleware, meaning the requests go straight to the business logic handlers. Successful exploitation lets an attacker read the full UP-node and link topology, inject attacker-controlled UP-node and link configurations, and delete existing UP-node links, disrupting or hijacking user-plane traffic routing. A patched-image rebuild at version 4.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SMF Service-Based Interface port over the network; any system with routable access to the SBI can send unauthenticated UPI requests.

• AuthenticationNot required

  No credentials, bearer token, or OAuth2 grant of any kind are required; the route group is mounted without authorization middleware so requests reach handlers anonymously.

• Victim interactionNot required

  The attacker sends HTTP requests directly to the SMF; no user action or social engineering is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker sends a standard HTTP request with no special timing, memory layout knowledge, or environmental precondition required.

Blast Radius

• Reads the full UP-node and link topology, exposing the internal user-plane graph including node identifiers and link relationships.
• Writes attacker-controlled UP-node and link entries, allowing injection of rogue user-plane nodes that can redirect subscriber traffic flows.
• Deletes existing UP-node links, breaking user-plane paths and causing service disruption for active 5G sessions.
• The CVSS scope is Changed, meaning impact can extend beyond the SMF process itself to the broader 5G user-plane infrastructure it manages.