PatchSiren cyber security CVE debrief
CVE-2026-8122 Open5gs CVE debrief
CVE-2026-8122 is a denial-of-service issue reported in Open5GS NSSF, specifically in ogs_sbi_discovery_option_add_service_names within /lib/sbi/message.c. The supplied record says affected versions extend through 2.7.7, the attack can be performed remotely, and a public exploit has been referenced. NVD has analyzed the issue and assigns a low availability impact in its CVSS v4.0 vector, but the combination of remote reachability and a public exploit means exposed deployments should treat it as operationally relevant despite the low numeric score.
- Vendor
- Open5gs
- Product
- Unknown
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-08
- Original CVE updated
- 2026-05-11
- Advisory published
- 2026-05-08
- Advisory updated
- 2026-05-11
Who should care
Operators and integrators running Open5GS, especially environments using the NSSF component or exposing SBI-facing services to untrusted networks. Security teams responsible for telecom core infrastructure should review whether any deployed instance is at or below version 2.7.7.
Technical summary
The vulnerability is tied to ogs_sbi_discovery_option_add_service_names in Open5GS's /lib/sbi/message.c, under the NSSF component. The source corpus describes the flaw as a manipulation that leads to denial of service, and the NVD record maps it to a network-reachable issue with low privileges required and low availability impact. The affected CPE range listed by NVD is Open5GS versions up to and including 2.7.7.
Defensive priority
Medium
Recommended defensive actions
- Inventory all Open5GS deployments and confirm whether NSSF is enabled or reachable.
- Identify any systems running Open5GS version 2.7.7 or earlier and prioritize upgrade or vendor remediation as soon as a fixed release is available.
- Restrict exposure of SBI and related management or inter-service interfaces to trusted networks only.
- Monitor for abnormal NSSF behavior, process crashes, or service interruptions that could indicate attempted triggering of this issue.
- Track the GitHub issue and vendor/NVD references for a confirmed fix or mitigation guidance.
Evidence notes
Source evidence in the supplied corpus includes the NVD analyzed record, which lists Open5GS as the affected product, a vulnerable CPE range ending at 2.7.7, a CVSS v4.0 vector indicating network attack, low privileges, and low availability impact, and references to the Open5GS repository plus GitHub issue 4435. The description supplied with the CVE states the issue can be performed remotely, causes denial of service, and that a public exploit has been made available. No fixed version is included in the provided source material.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-8122 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-8122
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-8122 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8122
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/open5gs/open5gs/
[email protected] - Product
-
Source reference
Unverified legacy reference
URL: https://github.com/open5gs/open5gs/issues/4435
[email protected] - Exploit, Issue Tracking
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://vuldb.com/submit/808425
[email protected] - Third Party Advisory, VDB Entry, Exploit
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://vuldb.com/vuln/361909
[email protected] - Third Party Advisory, VDB Entry
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/vuln/361909/cti
[email protected] - Permissions Required, VDB Entry
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.