CVE-2026-44330: free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

Synopsis

This is an authentication bypass in the free5GC open-source 5G core network's Network Exposure Function (NEF). The nnef-pfdmanagement API route group is mounted without any OAuth2 or bearer-token validation middleware, meaning any network-reachable attacker can send a forged or arbitrary bearer token and be accepted without challenge. Successful exploitation lets an attacker read Packet Flow Description (PFD) application data and create or delete PFD change-notification subscriptions, disrupting or manipulating how traffic policy is distributed across the 5G core. A patched-image rebuild at version 4.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NEF Service Based Interface (SBI) over the network; any host with IP connectivity to the NEF endpoint can attempt the attack.

• AuthenticationNot required

  No valid credentials are needed; the middleware that would validate OAuth2 bearer tokens is absent, so a forged or arbitrary token value is accepted without verification.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from any user or operator.

• Attack complexityDetail

  The exploit is reliable and condition-free: sending any HTTP request with an Authorization header to the unprotected route group succeeds unconditionally.

Blast Radius

• Reads all PFD application records exposed via GET /applications and GET /applications/{appID}, including traffic-descriptor rules operators use to classify subscriber data flows.
• Creates arbitrary PFD change-notification subscriptions via POST /subscriptions, injecting attacker-controlled callback endpoints into the 5G core notification fabric.
• Deletes existing PFD subscriptions via DELETE /subscriptions/{subID}, preventing legitimate network functions from receiving policy update notifications and disrupting traffic steering across the core.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the NEF process itself to downstream network functions that consume PFD data.