CVE-2026-42081 Overview
CVE-2026-42081 affects free5GC, an open-source implementation of the 5G core network. The Access and Mobility Management Function (AMF) fails to verify User Equipment (UE) Security Capabilities received in NGAP PathSwitchRequest messages against locally stored values. This validation is mandated by 3GPP TS 33.501 §6.7.3.1. A malicious gNB can overwrite the AMF's stored UE security capabilities with arbitrary values. The corrupted values propagate through PathSwitchRequest Acknowledge and subsequent Handover Request messages. The vulnerability is fixed in free5GC version 4.2.2.
Critical Impact
A malicious gNB on the adjacent network can cause persistent handover denial-of-service for affected UEs by corrupting AMF-stored security capabilities.
Affected Products
- free5GC versions prior to 4.2.2
- AMF (Access and Mobility Management Function) component
- 5G core network deployments using free5GC
Discovery Timeline
- 2026-05-27 - CVE-2026-42081 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-42081
Vulnerability Analysis
The vulnerability resides in free5GC's AMF handling of NGAP (NG Application Protocol) PathSwitchRequest messages. During an Xn-based handover, the target gNB sends a PathSwitchRequest to the AMF containing UE Security Capabilities. The AMF must compare these received capabilities against locally stored values from the initial UE registration. This comparison is required by 3GPP TS 33.501 §6.7.3.1 to prevent bidding-down attacks. free5GC's AMF skips this verification step and accepts the received values without validation. The flaw is classified as [CWE-358] (Improperly Implemented Security Check for Standard).
Root Cause
The root cause is a missing security check in the AMF's NGAP handler for PathSwitchRequest processing. The implementation directly overwrites the stored UE Security Capabilities with values supplied by the gNB. No comparison occurs against the authenticated values established during the initial NAS Security Mode Command procedure. This deviates from the 3GPP specification requirement to detect and reject mismatched capability claims.
Attack Vector
An attacker operating a malicious or compromised gNB on the radio access network can send crafted PathSwitchRequest messages with arbitrary UE Security Capability values. The AMF accepts these forged capabilities and stores them as the authoritative values for the targeted UE. The corrupted state is then propagated in PathSwitchRequest Acknowledge responses and in any subsequent Handover Request messages sent to neighboring gNBs. Receiving gNBs reject handovers when the advertised capabilities are inconsistent or unsupported, producing persistent handover denial-of-service for affected subscribers. Exploitation requires adjacent network access to the N2 interface between gNB and AMF.
No public exploit code is available for this vulnerability. Refer to the GitHub Security Advisory for additional technical detail.
Detection Methods for CVE-2026-42081
Indicators of Compromise
- Unexpected changes to stored UE Security Capabilities in AMF state without a corresponding new NAS registration
- Repeated Handover Failure responses from target gNBs for specific UEs following a PathSwitchRequest
- NGAP PathSwitchRequest messages containing UE Security Capability values that diverge from initial registration values
Detection Strategies
- Log and audit all NGAP PathSwitchRequest and PathSwitchRequest Acknowledge messages at the AMF and compare UE Security Capabilities to initial registration values
- Alert on anomalous handover failure rates for individual UEs or originating from specific gNB identifiers
- Inspect N2 interface traffic for capability fields that change between successive procedures for the same UE
Monitoring Recommendations
- Correlate AMF logs with gNB identifiers to identify rogue or misbehaving base stations
- Track per-UE handover success and failure metrics over time to surface persistent denial conditions
- Monitor free5GC AMF application logs for NGAP processing anomalies and capability mismatches
How to Mitigate CVE-2026-42081
Immediate Actions Required
- Upgrade free5GC to version 4.2.2 or later, which includes the fix for AMF capability verification
- Inventory all free5GC deployments and identify AMF instances running versions prior to 4.2.2
- Restrict N2 interface access to authenticated and trusted gNBs only
Patch Information
The vulnerability is fixed in free5GC version 4.2.2. The patch implements the 3GPP TS 33.501 §6.7.3.1 requirement to validate UE Security Capabilities in PathSwitchRequest messages against locally stored values. Details are available in the GitHub Security Advisory GHSA-77x9-rf64-92gv.
Workarounds
- Enforce IPsec or equivalent transport security on the N2 interface between gNBs and the AMF to limit exposure to unauthorized gNBs
- Apply network segmentation to ensure only vetted RAN nodes can reach the AMF NGAP endpoint
- Increase logging verbosity on the AMF to capture all PathSwitchRequest processing for forensic review until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
