10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44330

CVE-2026-44330: free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44330

CVE-2026-44330:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/nef	go	<= 1.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing authentication flaw in the free5GC Network Exposure Function (NEF). Specifically, the nnef-pfdmanagement API route group was mounted without any inbound authentication or authorization checks. This was done within the server.NewServer function in internal/sbi/server.go, which is responsible for setting up the HTTP server and its routes. An attacker with network access to the NEF's Service-Based Interface (SBI) could send forged requests to the API endpoints within this group.

The patch (b16537cc7ffe779c15155fe5cd23b015e1404e80) addresses this by introducing an OAuth2 middleware. The NewServer function was refactored to apply this middleware (nef_util.NewRouterAuthorizationCheck) to all sensitive route groups, including nnef-pfdmanagement. This ensures that incoming requests must have a valid bearer token.

The vulnerable functions are the HTTP handlers that were processing these unauthenticated requests. As detailed in the vulnerability report and confirmed by the PoC logs, these are processor.GetApplicationsPFD, processor.GetIndividualApplicationPFD, processor.PostPFDSubscriptions, and processor.DeleteIndividualPFDSubscription, all located in internal/sbi/processor/pfdf.go. Exploitation of these functions allows an attacker to read sensitive PFD data and create or delete PFD subscriptions, leading to information leakage and denial of service.

Vulnerable functions

server.NewServer

internal/sbi/server.go

The `NewServer` function was responsible for mounting the API route groups. The vulnerability existed because the `nnef-pfdmanagement` route group, along with others, was mounted without any authentication middleware. The patch refactors this function to conditionally mount route groups and applies an OAuth2 middleware (`authCheck`) to each group, including the one for PFD management, thus fixing the missing authentication vulnerability.

processor.GetApplicationsPFD

internal/sbi/processor/pfdf.go

This function acts as the handler for `GET /nnef-pfdmanagement/v1/applications`. Due to the lack of authentication on its route group, an unauthenticated attacker could call this function to read Packet Flow Description (PFD) application data, leading to information disclosure.

processor.GetIndividualApplicationPFD

internal/sbi/processor/pfdf.go

This function acts as the handler for `GET /nnef-pfdmanagement/v1/applications/{appID}`. It was exposed without authentication, allowing an unauthenticated attacker to retrieve PFD data for a specific application, leading to information disclosure.

processor.PostPFDSubscriptions

internal/sbi/processor/pfdf.go

This function acts as the handler for `POST /nnef-pfdmanagement/v1/subscriptions`. It was exposed without authentication, allowing an unauthenticated attacker to create arbitrary PFD change-notification subscriptions, potentially turning the NEF into an outbound request source for the attacker.

processor.DeleteIndividualPFDSubscription

internal/sbi/processor/pfdf.go

This function acts as the handler for `DELETE /nnef-pfdmanagement/v1/subscriptions/{subID}`. It was exposed without authentication, allowing an unauthenticated attacker to delete legitimate PFD subscriptions, leading to a denial of service for change notifications.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44330: free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

CVE-2026-44330:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

10

10

CVE-2026-44330: free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

Technical Details

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44330: free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

CVE-2026-44330:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

10

10

CVE-2026-44330: free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI