CVE-2026-40248

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

View on CVE.org

Published Apr 16, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for creating or updating Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execution continues and the subscription is created or overwritten regardless. An unauthenticated attacker with access to the 5G Service Based Interface can create or overwrite arbitrary Traffic Influence Subscriptions, including injecting attacker-controlled notificationUri values and arbitrary SUPIs, by supplying any value for the influenceId path segment. A patched version was not available at the time of publication.

Analysis

Technical impact

An incomplete path validation in the free5gc UDR service allows an unauthenticated attacker to create or overwrite Traffic Influence Subscriptions, regardless of the influenceId supplied. This flaw enables an attacker to inject arbitrary notificationUri values and SUPIs, potentially redirecting traffic or exfiltrating data. The vulnerability is a form of improper access control and path injection (CWE-285 and CWE-636), providing the attacker with elevated control over subscription mechanisms without authentication.

Affected Systems

The issue affects the free5gc UDR service version 4.2.1 and any older releases. No official patch was available at the time of disclosure, and the vulnerability remains in all affected deployments that have not been updated.

Risk and Exploitability

The CVSS score of 8.7 signifies high severity. Although EPSS data is not available, the vulnerability is exploitable via the 5G Service Based Interface without authentication. The lack of a KEV listing does not diminish the risk; any system exposing the UDR may be vulnerable. Attackers can create or modify subscriptions remotely, potentially compromising data integrity and confidentiality in the network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

free5gc

affected

Version	Status	Constraints
`<= 1.4.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Free5gc

Version	Status	Scheme	Platform
`[0,1.4.2]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade free5gc to a patched version as soon as it becomes available.
Configure network or firewall rules to restrict unauthenticated access to the UDR Service Based Interface endpoints.
Enable logging and monitoring of Traffic Influence Subscription creation and updates to detect unauthorized activity.

Generated by OpenCVE AI on April 17, 2026 at 02:24 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-jgq2-qv8v-5cmj	free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.443% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/free5gc/free5gc/security/advisories/GHSA-jgq2-qv8v-5cmj

History

Apr 23, 2026 7:30 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:free5gc:free5gc::::::::
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

Apr 20, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 16, 2026 11:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Free5gc Free5gc free5gc
Vendors & Products		Free5gc Free5gc free5gc

Apr 16, 2026 10:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for creating or updating Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execution continues and the subscription is created or overwritten regardless. An unauthenticated attacker with access to the 5G Service Based Interface can create or overwrite arbitrary Traffic Influence Subscriptions, including injecting attacker-controlled notificationUri values and arbitrary SUPIs, by supplying any value for the influenceId path segment. A patched version was not available at the time of publication.
Title		free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
Weaknesses		CWE-285 CWE-636
References		https://github.com/free5gc/free5gc/security/advisories/GHSA-jgq2-qv8v-5cmj
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`