CVE-2026-37233: Mosaic5g FlexRIC Auth Bypass Vulnerability

CVE-2026-37233 Overview

CVE-2026-37233 is an authorization bypass vulnerability in Mosaic5g FlexRIC v2.0.0, an Open RAN (O-RAN) near-real-time RAN Intelligent Controller (nRT-RIC) implementation. The flaw resides in the iApp's xApp isolation mechanism, where an incorrect comparison in the equality function eq_xapp_ric_gen_id() causes the iApp to ignore the xApp identity dimension. A malicious xApp connected to the iApp endpoint on port 36422 can delete subscriptions belonging to any other xApp sharing the same RIC. The defect breaks multi-tenant isolation in deployments running multiple xApps against a single RIC instance.

Critical Impact
A network-resident xApp can issue forged subscription delete requests that revoke other tenants' active subscriptions, disrupting RAN telemetry and control flows.

Affected Products

Mosaic5g FlexRIC version 2.0.0
Deployments using the iApp xApp isolation mechanism on port 36422
Multi-xApp O-RAN environments sharing a single RIC instance

Discovery Timeline

2026-06-01 - CVE-2026-37233 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-37233

Vulnerability Analysis

The vulnerability is a reachable assertion-class logic flaw classified as [CWE-617]. The iApp component within FlexRIC tracks xApp subscriptions using a composite identifier known as the ric_gen_id, which is intended to bind a subscription to both the originating xApp and the requested RAN function. When the iApp receives an E42_RIC_SUBSCRIPTION_DELETE_REQUEST, it iterates registered subscriptions and uses eq_xapp_ric_gen_id() to locate the matching entry before removal.

Because the comparison short-circuits the xApp identity check, any xApp authenticated to port 36422 can target subscriptions owned by other xApps. The exploit requires only network reach to the iApp listener and knowledge or enumeration of the target ric_gen_id values. There is no requirement for elevated privileges or user interaction, and the impact is confined to availability of subscription state across tenants.

Root Cause

The defect is located in src/ric/iApp/xapp_ric_id.c. The equality function eq_xapp_ric_gen_id() compares m0->xapp_id against itself (m0->xapp_id) rather than against the second argument m1->xapp_id. The self-comparison always evaluates true, so the xApp identity dimension is effectively dropped from the equality check, collapsing multi-tenant scoping into a single shared namespace.

Attack Vector

An attacker controlling or impersonating any xApp that can connect to the iApp on TCP port 36422 sends a crafted E42_RIC_SUBSCRIPTION_DELETE_REQUEST containing a ric_gen_id matching the victim xApp's subscription. The iApp's flawed equality check matches the request to the victim's record regardless of the requesting xApp's identity, and the subscription is removed. Repeated requests can systematically dismantle every active subscription on the RIC, disrupting closed-loop RAN control and telemetry pipelines. No verified public proof-of-concept is published at this time; see the GitHub Security Advisory CVE-2026-37233 for the upstream technical write-up.

Detection Methods for CVE-2026-37233

Indicators of Compromise

Unexpected E42_RIC_SUBSCRIPTION_DELETE_REQUEST messages arriving on iApp port 36422 from xApps that did not create the referenced subscription.
Sudden loss of active subscriptions across multiple xApps within a short time window without corresponding administrative action.
xApp logs reporting failed callbacks or missing indication messages immediately after a peer xApp connects.

Detection Strategies

Instrument the iApp to log every subscription delete request with both the requesting xApp identifier and the target ric_gen_id, then alert on mismatches.
Correlate xApp connection events on port 36422 with subsequent subscription delete activity to identify tenant boundary violations.
Baseline normal subscription lifecycles per xApp and flag deletions that originate from a different xApp than the original subscriber.

Monitoring Recommendations

Capture E2AP and E42 control-plane traffic between xApps and the iApp for forensic replay.
Track subscription counts per xApp as a time-series metric and alert on abrupt drops.
Forward FlexRIC iApp logs to a centralized analytics platform with retention sufficient for cross-event correlation.

How to Mitigate CVE-2026-37233

Immediate Actions Required

Restrict network access to the iApp listener on port 36422 to trusted, authenticated xApps using firewall rules or service mesh policies.
Apply the upstream source fix to eq_xapp_ric_gen_id() so the comparison evaluates m0->xapp_id == m1->xapp_id, then rebuild and redeploy FlexRIC.
Audit existing subscription state and re-register any subscriptions that may have been removed by unauthorized requests.

Patch Information

Mosaic5g FlexRIC is distributed via the GitLab Project Repository. Operators running version 2.0.0 should track the upstream repository for a corrected eq_xapp_ric_gen_id() implementation and rebuild from a patched commit. Refer to the GitHub Security Advisory CVE-2026-37233 for advisory updates and fix references.

Workarounds

Deploy each xApp in an isolated RIC instance until a patched build is available, eliminating shared-tenant exposure.
Place an authenticating proxy in front of port 36422 that validates the requesting xApp identity against the target ric_gen_id before forwarding delete requests.
Disable or remove untrusted xApps from the deployment to reduce the population of potential attackers with iApp connectivity.

bash

# Configuration example: restrict iApp port 36422 to a known xApp subnet
iptables -A INPUT -p tcp --dport 36422 -s 10.0.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36422 -j DROP