7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44321

CVE-2026-44321: free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-controlled JSON and passes it directly into UpNodesFromConfiguration(), which calls logger.InitLog.Fatalf(...) on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (docker ps shows Exited (1)), not just the goroutine. This vulnerability is fixed in 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44321

CVE-2026-44321:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/smf	go	<= 1.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the free5gc/smf service, where the /upi/v1/upNodesLinks API endpoint is exposed without authentication. This endpoint's handler, PostUpNodesLinks, processes incoming JSON data by calling UpNodesFromConfiguration. This function, along with NewUserPlaneInformation which it utilizes, performed validation checks on the user-provided data. Crucially, upon validation failure (e.g., detecting overlapping IP address pools), these functions would call logger.InitLog.Fatalf. This function terminates the entire process, leading to a denial of service. An unauthenticated attacker can send a simple POST request with a crafted JSON payload to trigger this condition and crash the SMF process. The fix involves changing the validation functions to return errors instead of calling Fatalf, and updating the API handler to catch these errors and return a standard HTTP error response, thus preventing the process from crashing.

Vulnerable functions

UserPlaneInformation.UpNodesFromConfiguration

internal/context/user_plane_information.go

This function processes user-provided topology information. Before the patch, it would call `logger.InitLog.Fatalf` if it detected overlapping IP address pools, which is equivalent to `os.Exit(1)` and terminates the entire SMF process. An unauthenticated attacker could trigger this by sending a specially crafted POST request.

NewUserPlaneInformation

internal/context/user_plane_information.go

This function is called during the initialization of the user plane information. It contained several calls to `logger.InitLog.Fatalf` for various validation failures, such as invalid or overlapping IP pools. The vulnerability is that this validation logic, which can terminate the process, is reachable by an unauthenticated API endpoint.

Server.PostUpNodesLinks

internal/sbi/api_upi.go

This is the HTTP handler for the `POST /upi/v1/upNodesLinks` endpoint. It is the entry point for the vulnerability. It takes the user-controlled JSON payload and passes it to `UpNodesFromConfiguration` without proper authentication. Before the patch, it did not handle errors returned from the downstream function, allowing the process to crash.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.