CVE-2026-33906: Ella Core Privilege Escalation Vulnerability

CVE-2026-33906 Overview

CVE-2026-33906 is a privilege escalation vulnerability affecting Ella Core, a 5G core network solution designed for private networks. The vulnerability exists in versions prior to 1.7.0 where the NetworkManager role was incorrectly granted backup and restore permissions. The restore endpoint accepted any valid SQLite file without verifying its contents, allowing a NetworkManager to replace the production database with a tampered copy and escalate privileges to Admin.

Critical Impact
A NetworkManager can escalate to Admin privileges by uploading a malicious SQLite database, gaining unauthorized access to user management, audit logs, debug endpoints, and operator identity configuration that the role was explicitly denied.

Affected Products

Ella Core versions prior to 1.7.0
Private 5G network deployments using Ella Core
Environments where NetworkManager role has backup/restore access

Discovery Timeline

2026-03-27 - CVE CVE-2026-33906 published to NVD
2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33906

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-269) in the role-based permission system of Ella Core. The NetworkManager role, which should have limited administrative capabilities, was granted backup and restore permissions that enabled database manipulation. The restore endpoint's lack of content validation creates a critical attack surface where an authenticated NetworkManager can inject a crafted database file containing elevated privilege assignments.

The impact of successful exploitation is significant. An attacker with NetworkManager credentials can gain full administrative control over the 5G core network, including access to sensitive components such as user management systems, audit logs, debug endpoints, and operator identity configuration. This effectively bypasses all role-based access controls designed to limit NetworkManager capabilities.

Root Cause

The root cause is improper privilege assignment (CWE-269: Improper Privilege Management) where the NetworkManager role was incorrectly granted backup and restore permissions. Additionally, the restore endpoint failed to implement content validation or integrity checks on uploaded SQLite database files, allowing arbitrary database replacement without verification.

Attack Vector

The attack requires network access and high privileges (NetworkManager role credentials). An attacker with NetworkManager access can exploit this vulnerability by:

Creating a malicious SQLite database file with elevated user privileges
Using the restore endpoint to upload the tampered database
Replacing the production database with the malicious copy
Logging in with Admin-level privileges to access restricted functionality

The vulnerability can be exploited remotely over the network without user interaction. The restore endpoint accepts any valid SQLite file structure, enabling privilege escalation through database content manipulation. Detailed technical information is available in the GitHub Security Advisory GHSA-87j9-m7x6-hvw2.

Detection Methods for CVE-2026-33906

Indicators of Compromise

Unexpected database restore operations initiated by NetworkManager accounts
Sudden privilege changes in user accounts without corresponding audit trail
NetworkManager accounts accessing Admin-only endpoints such as user management, debug, or audit logs
Database backup files with unexpected modification timestamps

Detection Strategies

Monitor API logs for calls to the backup/restore endpoint from NetworkManager roles
Implement database integrity monitoring to detect unauthorized modifications to privilege tables
Alert on privilege escalation events where NetworkManager accounts gain Admin access
Review audit logs for gaps or inconsistencies that may indicate log tampering after exploitation

Monitoring Recommendations

Enable detailed logging for all backup and restore operations
Implement file integrity monitoring on the SQLite database files
Configure alerts for role permission changes in the user management system
Monitor for unusual access patterns from NetworkManager accounts to restricted endpoints

How to Mitigate CVE-2026-33906

Immediate Actions Required

Upgrade Ella Core to version 1.7.0 or later immediately
Audit all NetworkManager accounts for unauthorized privilege escalation
Review database restore logs for suspicious activity
Verify database integrity by comparing against known-good backups

Patch Information

The vulnerability has been addressed in Ella Core version 1.7.0. The fix removes backup and restore permissions from the NetworkManager role entirely. Organizations should upgrade to this version as soon as possible.

Patched Version:1.7.0
Fix Commit:GitHub Commit 1e47682
Release Notes:GitHub Release v1.7.0

Workarounds

Revoke backup and restore permissions from NetworkManager roles manually if upgrade is not immediately possible
Implement network segmentation to restrict access to the restore endpoint
Require multi-factor authentication for any database restore operations
Add manual approval workflow for database restore operations until patch is applied

bash

# Verify Ella Core version after upgrade
ella-core --version
# Expected output: 1.7.0 or higher

# Review NetworkManager role permissions
ella-core role show NetworkManager
# Verify backup/restore permissions are not present