10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44329

CVE-2026-44329: free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44329

CVE-2026-44329:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/smf	go	< 1.4.3	1.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic missing authentication for a critical function (CWE-306). The root cause lies in the sbi.newRouter function in internal/sbi/server.go, where the routes for the UPI (User Plane Interface) management API were mounted without the necessary OAuth2 authorization middleware. The patch, identified in commit e23ce97565f285eb99eed153743c62bf4c767c6e, rectifies this by adding an authorization check to the upiGroup. As a result of this omission, the handler functions sbi.Server.GetUpNodesLinks, sbi.Server.PostUpNodesLinks, and sbi.Server.DeleteUpNodeLink in internal/sbi/api_upi.go were exposed to unauthenticated network attackers. An attacker could read, modify, or delete the network's user plane topology, leading to traffic redirection, information disclosure, or denial of service. The identified vulnerable functions are the handlers that would process these malicious, unauthenticated requests during an exploit.

Vulnerable functions

sbi.newRouter

internal/sbi/server.go

This function is responsible for setting up the HTTP router. The vulnerability existed because this function did not apply any authentication or authorization middleware to the '/upi' route group, allowing unauthenticated access to all endpoints under it.

sbi.Server.GetUpNodesLinks

internal/sbi/api_upi.go

This function handles GET requests to '/upi/v1/upNodesLinks'. Due to the missing authentication middleware in `newRouter`, an attacker could call this function without authentication to read sensitive UP-plane topology information.

sbi.Server.PostUpNodesLinks

internal/sbi/api_upi.go

This function handles POST requests to '/upi/v1/upNodesLinks'. Due to the missing authentication middleware in `newRouter`, an attacker could call this function without authentication to inject malicious UPF nodes and links, poisoning the SMF's view of the network topology.

sbi.Server.DeleteUpNodeLink

internal/sbi/api_upi.go

This function handles DELETE requests to '/upi/v1/upNodesLinks/:upNodeRef'. Due to the missing authentication middleware in `newRouter`, an attacker could call this function without authentication to delete arbitrary UPF nodes from the topology, causing denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.