CVE-2026-40247: free5GC UDR Information Disclosure Flaw

CVE-2026-40247 Overview

CVE-2026-40247 is an Improper Authorization vulnerability (CWE-285) affecting the free5GC open-source 5G core network implementation. The vulnerability exists in the UDR (Unified Data Repository) service's handler for reading Traffic Influence Subscriptions. A critical flaw in the validation logic allows the handler to continue execution and return sensitive subscription data even after sending an HTTP 404 response when the influenceId path segment validation fails.

Critical Impact

An unauthenticated attacker with network access to the 5G Service Based Interface can read arbitrary Traffic Influence Subscriptions, exposing sensitive subscriber identifiers (SUPIs/IMSIs), Data Network Names (DNNs), Single Network Slice Selection Assistance Information (S-NSSAIs), and callback URIs.

Affected Products

• free5GC UDR service version 4.2.1 and below
• free5GC 5G Core Network implementations using vulnerable UDR versions

Discovery Timeline

• April 16, 2026 - CVE-2026-40247 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40247

Vulnerability Analysis

This vulnerability represents a classic case of improper authorization due to missing control flow termination. The UDR service handler responsible for reading Traffic Influence Subscriptions implements a validation check comparing the influenceId path segment against the string subs-to-notify. When this validation fails, the handler correctly generates and sends an HTTP 404 response. However, the critical flaw lies in what happens next—the function does not return or halt execution after sending the error response.

As a result, the code continues to execute the normal data retrieval logic, fetching the subscription data and returning it to the requester alongside the 404 status code. This behavior effectively bypasses the intended authorization control, as an attacker can supply any arbitrary value for the influenceId parameter and still receive the full subscription data payload.

The exposed data is particularly sensitive in 5G network contexts. SUPIs (Subscription Permanent Identifiers) and IMSIs (International Mobile Subscriber Identities) are unique subscriber identifiers that can be used for tracking and targeting specific users. DNNs and S-NSSAIs reveal network topology and slice configuration information, while callback URIs could expose internal service endpoints.

Root Cause

The root cause is a missing return statement after the HTTP 404 response is sent in the Traffic Influence Subscription handler. When the influenceId validation fails (i.e., when it does not equal subs-to-notify), the handler sends the 404 response but fails to terminate execution. This allows subsequent code that retrieves and returns subscription data to execute unconditionally.

This is a common programming error pattern known as "fall-through" or "missing return after error," where defensive checks are implemented but fail to prevent continued execution. The vulnerability is classified under CWE-285 (Improper Authorization) because the net effect is that authorization controls are not properly enforced.

Attack Vector

The attack vector is network-based, requiring an attacker to have access to the 5G Service Based Interface (SBI). This interface is typically exposed within the 5G core network but may be accessible to attackers who have compromised network access or in misconfigured deployments where the SBI is exposed to untrusted networks.

To exploit this vulnerability, an attacker sends an HTTP request to the Traffic Influence Subscription endpoint with any arbitrary value for the influenceId path segment. Despite receiving an HTTP 404 response status, the response body contains the full Traffic Influence Subscription data.

The attack requires no authentication, no user interaction, and has low complexity. An attacker with network access to the SBI can enumerate and extract all Traffic Influence Subscriptions by iterating through possible subscription identifiers, gaining access to sensitive 5G subscriber information.

For additional technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40247

Indicators of Compromise

• HTTP 404 responses from the UDR service that contain non-empty response bodies with subscription data
• Unusual access patterns to Traffic Influence Subscription endpoints with varied or random influenceId values
• High volumes of requests to the /nudr-dr/v1/application-data/influenceData/{influenceId} endpoint
• Network traffic from unauthorized sources reaching the 5G Service Based Interface

Detection Strategies

• Monitor UDR service logs for 404 responses that include data payloads in the response body
• Implement network intrusion detection rules to flag requests to Traffic Influence Subscription endpoints from unauthorized network segments
• Deploy API gateway monitoring to detect enumeration attempts against subscription endpoints
• Correlate SBI access logs with authorized client lists to identify unauthorized access attempts

Monitoring Recommendations

• Enable detailed logging on the UDR service to capture full request and response details
• Implement alerting for anomalous access patterns to sensitive subscription data endpoints
• Monitor for reconnaissance activity targeting 5G core network APIs
• Audit network access controls to the Service Based Interface regularly

How to Mitigate CVE-2026-40247

Immediate Actions Required

• Restrict network access to the 5G Service Based Interface to authorized network segments only
• Implement additional authentication and authorization controls at the API gateway level for the UDR service
• Deploy network segmentation to isolate the 5G core network from untrusted networks
• Monitor for exploitation attempts using the detection strategies outlined above

Patch Information

A patched version was not available at the time of publication. Organizations should monitor the free5GC GitHub repository for security updates and apply patches as soon as they become available.

Workarounds

• Implement a reverse proxy or API gateway in front of the UDR service that validates responses and blocks 404 responses containing subscription data
• Apply network-level access controls to limit SBI access to trusted network segments only
• Consider deploying a Web Application Firewall (WAF) with custom rules to inspect and filter Traffic Influence Subscription API responses
• If feasible, temporarily disable the Traffic Influence Subscription endpoint until a patch is available

# Example: iptables rules to restrict SBI access to trusted network only
# Replace 10.0.0.0/24 with your trusted 5G core network segment
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP