LiveActive security incident?Get immediate response
CVE Record

CVE-2026-55068: free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

CriticalCVSS 9.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in free5GC’s Network Repository Function lets an attacker with service-based interface access register false network functions. Trusted components may then send sensitive 5G control-plane traffic to attacker-controlled endpoints, potentially exposing credentials, corrupting service discovery, or disrupting network services.

Executive priority

Treat exposed or production 5G core deployments as an immediate remediation priority. Upgrade promptly, restrict SBI access, and investigate suspicious registrations because successful poisoning could compromise signaling confidentiality, integrity, and availability across dependent network functions.

Technical view

In free5GC 4.2.2 and earlier, the NRF registration handler insufficiently validates NF Profiles before storing them in MongoDB. Invalid identifiers, statuses, timers, mandatory fields, and service endpoint addresses can persist and be returned through NFDiscover. This enables registration poisoning and redirection of signaling. The source bundle assigns CVSS 4.0 score 9.3 and CWE-20.

Likely exposure

Deployments running free5GC before 4.2.3 are affected. Practical exposure depends on whether an attacker can reach the NRF service-based interface. Environments exposing that interface beyond tightly controlled network functions face greater risk because the supplied vector requires no privileges or user interaction.

Exploitation context

The source bundle does not report active exploitation and marks the CVE as absent from KEV. It also provides no evidence of a public exploit. Exploitation nevertheless appears technically serious because a network-reachable attacker with SBI access could submit poisoned profiles that other network functions trust.

Researcher notes

The security boundary is the NRF’s acceptance and persistence of attacker-supplied NF Profiles. Validation should cover both registration rejection and prevention of poisoned discovery responses. The bundle identifies corrective NRF commits and releases, but supplies no evidence of exploitation in the wild or details establishing how commonly SBI interfaces are exposed.

Mitigation direction

  • Upgrade affected free5GC deployments to version 4.2.3 or later.
  • Restrict NRF service-based interface access to explicitly authorized network functions.
  • Review stored NF Profiles and remove unauthorized or structurally invalid registrations.
  • Monitor vendor advisories for additional remediation or compromise guidance.

Validation and detection

  • Inventory free5GC versions and identify every deployment earlier than 4.2.3.
  • Confirm untrusted networks cannot reach the NRF registration interface.
  • Inspect stored NF Profiles for invalid identifiers, statuses, timers, missing fields, or unexpected endpoints.
  • Verify NFDiscover returns only approved network functions and service endpoints.
  • Review registration and discovery logs for unfamiliar instances or endpoint changes.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-55068 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.3 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——GitHub_M

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-55068Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
free5gcfree5gc< 4.2.3Listed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

Improper Input Validation

Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs