CVE-2026-55068

free5GC 4.2.2 and earlier fail to validate NF Profiles submitted to the NRF RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}), skipping checks on UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, and nfServices.ipEndPoints address constraints. An attacker with access to the 5G service-based interface (SBI) can register malformed or attacker-controlled profiles, which are persisted in the MongoDB NfProfile collection and returned to other network functions via NFDiscover. This lets the attacker advertise controlled endpoints for network functions, redirecting 5G control-plane signaling to expose credentials and signaling data, undermine service discovery integrity, or deny service to network functions that trust the NRF. Any operator running free5GC 4.2.2 or earlier — typically labs, research testbeds, and private 5G deployments — is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to free5GC 4.2.3, which enforces validation of NF Profile fields. Until then, restrict SBI access to the NRF's PUT /nnrf-nfm/v1/nf-instances endpoint to trusted network functions and management networks. Inspect the MongoDB NfProfile collection for malformed or unexpected entries and audit whether NFDiscover responses have directed network functions to attacker-controlled endpoints.