CVE-2026-40246 free5gc CVE debrief

Who should care

5G network defenders, administrators, and security teams responsible for free5GC UDR service deployment and management should verify and mitigate exposure. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-40246 is a high-severity vulnerability in free5GC UDR service that allows an unauthenticated attacker to delete arbitrary Traffic Influence Subscriptions. Defenders should verify and mitigate exposure, as the API misleadingly returns a 404 Not Found response, potentially obscuring exploitation attempts.

• Potential unauthorized deletion of Traffic Influence Subscriptions
• Misleading 404 Not Found response may obscure exploitation attempts
• Requires verification of free5GC UDR service version and mitigation of exposure
• May impact 5G network availability and security

Technical summary

The handler for deleting Traffic Influence Subscriptions in free5GC UDR service versions 1.4.2 and below does not return after sending the HTTP 404 response when validation fails, allowing an unauthenticated attacker to delete arbitrary subscriptions. This occurs because the validation check for influenceId path segment equality to subs-to-notify does not halt execution after sending a 404 response, enabling exploitation that could lead to unauthorized deletion of Traffic Influence Subscriptions and potentially impact 5G network availability and security.

Defensive priority

High priority for 5G network defenders and administrators to verify and mitigate exposure

Recommended defensive actions

• Verify the version of free5GC UDR service and upgrade to a patched version if available
• Restrict access to the 5G Service Based Interface
• Monitor for suspicious activity related to Traffic Influence Subscriptions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. A patched version was not available at the time of publication. Defenders should verify and mitigate exposure as the API misleadingly returns a 404 Not Found response, potentially obscuring exploitation attempts. The free5GC UDR service versions 1.4.2 and below are affected, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.