CVE-2026-55068

Received Received - Intake

NRF Profile Validation Bypass in free5GC

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55068

EUVD

EUVD-2026-67835

Affected Vendors & Products

Vendor	Product	Version / Range
free5gc	free5gc	to 4.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-55068 is a vulnerability in free5GC's Network Repository Function (NRF) where the system fails to validate Network Function (NF) registration requests properly. Attackers with access to the Service-Based Interface (SBI) can register malicious NF profiles with arbitrary service endpoints, redirecting control-plane signaling to attacker-controlled IPs. This allows interception of traffic, credential harvesting, or service disruption.

Detection Guidance

Monitor NRF registration requests for malformed NF profiles. Check MongoDB NfProfile collection for invalid UUIDs, out-of-range heartBeatTimer values, or arbitrary IP addresses in service endpoints. Inspect NRF logs for HTTP 200/201 responses to invalid registration attempts.

Impact Analysis

This vulnerability enables attackers to intercept sensitive control-plane signaling, harvest credentials like OAuth2 tokens, alter service discovery integrity, and deny service across network functions that trust the NRF. It requires only SBI network access and no configuration changes to exploit.

Mitigation Strategies

Upgrade free5GC NRF to version 4.2.3 or later. Implement input validation for NF profiles including UUID v4 checks, enum validation, and IP address constraints. Enable NRF logging to track registration attempts. Block unauthorized SBI access to the NRF endpoint.

Hi! I’m here to help you understand CVE-2026-55068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70