CVE-2026-42083 Overview
CVE-2026-42083 is a missing authorization vulnerability [CWE-862] in free5GC, an open-source implementation of the 5G core network. The flaw exists in the Policy Control Function (PCF) Npcf_SMPolicyControl service prior to version 4.2.2. The smPolicyGroup route group is created in NewServer() without attaching the RouterAuthorizationCheck middleware. Unauthenticated network attackers can reach Session Management (SM) policy handlers and disclose subscriber Subscription Permanent Identifier (SUPI) values. The issue is fixed in free5GC 4.2.2.
Critical Impact
Remote unauthenticated attackers with network access to the PCF can invoke SM policy create, read, update, and delete operations, leading to subscriber identity disclosure and policy tampering in a 5G core deployment.
Affected Products
- free5GC versions prior to 4.2.2
- free5GC PCF component (Npcf_SMPolicyControl service)
- 5G core deployments exposing the PCF SM policy API
Discovery Timeline
- 2026-05-27 - CVE-2026-42083 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-42083
Vulnerability Analysis
The vulnerability resides in the PCF service initialization logic. When NewServer() constructs the HTTP router for the Npcf_SMPolicyControl service, it registers the smPolicyGroup route group and attaches handlers directly. The RouterAuthorizationCheck middleware, which validates OAuth 2.0 access tokens used for inter-Network Function (NF) authentication in 5G Service Based Architecture (SBA), is never bound to this group.
Other PCF service groups, such as Npcf_PolicyAuthorization, correctly invoke RouterAuthorizationCheck before route registration. The inconsistency leaves all SM policy endpoints exposed without token validation. Because the PCF is reachable from any NF on the 5G core control plane, an attacker on that network can issue requests directly to the service.
Root Cause
The root cause is a missing authorization check [CWE-862] in the router wiring code. Authentication middleware was omitted for the smPolicyGroup while it was applied to peer service groups. The control plane handlers trust the router to enforce token validation, so they perform no secondary check on incoming requests.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to the PCF service can send HTTP requests to the following endpoints without an OAuth token:
- POST /npcf-smpolicycontrol/v1/sm-policies - create an SM policy association
- GET /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId} - retrieve subscriber policy data including SUPI
- POST /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/update - modify an existing policy
- POST /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/delete - terminate an SM policy association
Successful requests reach business logic, return subscriber-linked data, and can disrupt session management for legitimate users. Refer to the GitHub Security Advisory GHSA-6rgm-gr97-x3j5 for additional technical context.
Detection Methods for CVE-2026-42083
Indicators of Compromise
- HTTP requests to /npcf-smpolicycontrol/v1/sm-policies endpoints lacking an Authorization: Bearer header
- PCF access logs showing 2xx responses to SM policy requests from unexpected source IPs or non-SMF Network Functions
- Unexplained creation, modification, or deletion of SM policy associations not initiated by a Session Management Function (SMF)
- Outbound responses containing SUPI values delivered to clients that did not present a valid OAuth token
Detection Strategies
- Inspect PCF logs and reverse proxy logs for npcf-smpolicycontrol requests missing OAuth bearer tokens.
- Correlate SMF-originated session events with PCF SM policy transactions to find policy operations without a matching SMF flow.
- Deploy network detection rules on the 5G Service Based Interface (SBI) to flag requests to the affected routes that bypass the NRF token issuance flow.
Monitoring Recommendations
- Forward PCF access logs and SBI traffic metadata to a centralized analytics platform for retention and query.
- Alert on anomalous request rates or source NF identities targeting the Npcf_SMPolicyControl API.
- Track free5GC version inventory across lab and production cores to confirm patched builds are deployed.
How to Mitigate CVE-2026-42083
Immediate Actions Required
- Upgrade free5GC to version 4.2.2 or later, which attaches RouterAuthorizationCheck to the smPolicyGroup route group.
- Restrict network access to the PCF service so that only authorized NFs on the SBI can initiate connections.
- Audit PCF logs for prior unauthenticated access to SM policy endpoints and rotate any potentially exposed subscriber data tracking.
Patch Information
The fix is delivered in free5GC 4.2.2. The upstream commit 8c4d457 adds the missing authorization middleware to the smPolicyGroup initializer. See Pull Request #63 and GitHub Issue #844 for the upstream discussion and review.
Workarounds
- Place the PCF behind a service mesh or API gateway that enforces OAuth 2.0 token validation for /npcf-smpolicycontrol/v1/* routes until the upgrade is applied.
- Apply network segmentation and firewall rules so the PCF SBI listener is only reachable from authorized SMF instances.
- Disable or block external exposure of the PCF HTTP listener at the perimeter and on Kubernetes NetworkPolicies where applicable.
# Configuration example: upgrade free5GC PCF to the patched version
git clone https://github.com/free5gc/free5gc.git
cd free5gc
git checkout v4.2.2
git submodule update --init --recursive
make pcf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
