PatchSiren cyber security CVE debrief

CVE-2026-44327 free5gc CVE debrief

## Summary free5GC NEF (Network Exposure Function) prior to version 4.2.2 exposes the `nnef-oam` route group without OAuth2/bearer-token authorization. A network attacker with reachability to the NEF Service-Based Interface (SBI) can access OAM (Operations, Administration, and Maintenance) endpoints without providing any Authorization header, receiving HTTP 200 OK responses. While the current OAM handler is a stub returning null, the structural defect affects the entire route group—meaning any future OAM operations added to this group will inherit the missing authentication boundary by default. This represents a critical architectural vulnerability in 5G core network infrastructure. ## Technical Details - **Affected Component**: free5GC NEF (Network Exposure Function) - **Vulnerable Route Group**: `nnef-oam` - **Authentication Gap**: Missing OAuth2/bearer-token middleware on inbound requests - **Attack Vector**: Network-based, no authentication required - **Affected Versions**: Prior to 4.2.2 - **Fixed Version**: 4.2.2 The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). The CVSS 3.1 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope change (S:C), low confidentiality impact (C:L), high integrity impact (I:H), and high availability impact (A:H). ## Impact Assessment The critical severity (CVSS 10.0) reflects the combination of: - **Network accessibility**: NEF SBI interfaces are typically exposed to internal 5G core network segments - **No authentication barrier**: Complete absence of authorization checks - **Structural defect**: Future OAM functionality will automatically inherit the vulnerability - **High integrity/availability impact**: OAM functions typically control operational state of network functions In 5G architectures, the NEF serves as a gateway between external applications and 5G core network capabilities. Unauthorized OAM access could enable monitoring, configuration changes, or operational disruption of network exposure services. ## Timeline - **CVE Published**: 2026-05-27T17:16:38.