CVE-2026-30080 Openairinterface CVE debrief

Who should care

Organizations using OpenAirInterface v2.2.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Technical summary

The vulnerability is caused by OpenAirInterface v2.2.0 accepting Security Mode Complete without integrity protection. The configuration supports integrity NIA1 and NIA2, but if a UE sends an initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade in security context can lead to the possibility of replay attacks. The affected product is OpenAirInterface v2.2.0, and the defensive impact is highly critical due to the potential for replay attacks.

Defensive priority

Highly Critical

Recommended defensive actions

• Review and update OpenAirInterface configuration to enforce integrity protection
• Verify user equipment (UE) security capabilities and ensure they align with OpenAirInterface configuration
• Monitor for potential replay attacks and implement additional security measures as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-08T17:21:18.623Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. The vulnerability affects OpenAirInterface v2.2.0 and has a CVSS score of 7.5. The configuration supports integrity NIA1 and NIA2, but if a user equipment (UE) sends an initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade in security context can lead to the possibility of replay attacks. The evidence is limited, and defenders should verify the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.