CVE-2026-55068 free5gc CVE debrief

Who should care

Defenders of 5G core networks, especially those using free5GC, should assess exposure and verify the integrity of their service discovery mechanisms. This includes operators of 5G networks, platform providers, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their network functions and service discovery processes.

Why it matters

This critical vulnerability in free5GC allows attackers to advertise malicious network-function endpoints, potentially exposing credentials and signaling, altering service discovery integrity, and denying service. Defenders should prioritize verifying exposure, especially for 5G core network functions using free5GC versions 4.2.2 or earlier, and assess the integrity of their service discovery mechanisms.

• Exposure of credentials and signaling
• Alteration of service discovery integrity
• Denial of service across network functions that trust the NRF
• Potential for redirecting control-plane signaling

Technical summary

The NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} in free5GC 4.2.2 and earlier does not enforce UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. This allows an attacker with SBI access to advertise attacker-controlled network-function endpoints, potentially exposing credentials and signaling, altering service discovery integrity, and denying service across network functions that trust the NRF. The vulnerability can lead to exposure of credentials and signaling, alteration of service discovery integrity, and denial of service.

Defensive priority

Defenders should prioritize verifying exposure of 5G core network functions, especially those using free5GC versions 4.2.2 or earlier, and assess the integrity of their service discovery mechanisms.

Recommended defensive actions

• Verify and enforce proper validation of NF Profiles in 5G core network functions
• Assess exposure of free5GC versions 4.2.2 or earlier
• Update to version 4.2.3 or later
• Monitor service discovery mechanisms for integrity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub issues and commits related to the vulnerability are also available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.