CVE-2026-44475: Ella Core Auth Bypass Vulnerability

CVE-2026-44475 Overview

CVE-2026-44475 is a security control vulnerability in Ella Core, a 5G core designed for private networks. Versions prior to 1.10.0 fail to verify User Equipment (UE) Security Capabilities received in NGAP PathSwitchRequest messages against locally stored values. A malicious gNodeB (gNB) can overwrite the stored UE security capabilities for any UE by sending a single crafted PathSwitchRequest. The flaw is categorized under [CWE-358: Improperly Implemented Security Check for Standard]. Exploitation requires adjacent network access to the 5G control plane. The vulnerability is fixed in Ella Core 1.10.0.

Critical Impact
A malicious gNB on the adjacent network can overwrite the UE security capabilities stored by Ella Core for any UE, undermining negotiated cipher and integrity protections for 5G subscriber traffic.

Affected Products

Ella Core versions prior to 1.10.0
Private 5G core network deployments using affected Ella Core builds
NGAP signaling interfaces exposed to untrusted gNB nodes

Discovery Timeline

2026-05-27 - CVE CVE-2026-44475 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44475

Vulnerability Analysis

The vulnerability resides in how Ella Core handles the NGAP PathSwitchRequest procedure. In a correct 5G implementation, when a gNB initiates a path switch during handover, the Access and Mobility Management Function (AMF) must compare the UE Security Capabilities reported by the gNB against the values it already holds for that UE. The 3GPP specifications require this verification to prevent a rogue or compromised gNB from downgrading or altering the negotiated security context.

Ella Core skips this comparison and accepts the values supplied in the PathSwitchRequest as authoritative. The trust boundary between the radio access network and the core is therefore broken at this signaling step. An attacker controlling or impersonating a gNB can replace the cipher and integrity algorithm sets for any UE with arbitrary values.

Root Cause

The root cause is an improperly implemented security check for a standard procedure [CWE-358]. The NGAP handler trusts gNB-supplied capability information without validating it against the locally stored UE context maintained from the initial registration. This violates the integrity properties of the 5G AS/NAS security context negotiation.

Attack Vector

Exploitation occurs over the adjacent N2 (NGAP) interface between gNBs and the 5G core. The attacker must reach the control plane as a gNB peer, either by deploying a rogue base station with network connectivity to Ella Core or by compromising an existing gNB. The attacker sends a single crafted PathSwitchRequest referencing the target UE and specifying arbitrary UE Security Capabilities. Ella Core overwrites the stored values without further verification. No user interaction is required, and authentication on the NGAP interface is not required by the vulnerability itself.

The vulnerability description does not include verified proof-of-concept code. See the GitHub Security Advisory for technical details from the maintainers.

Detection Methods for CVE-2026-44475

Indicators of Compromise

NGAP PathSwitchRequest messages whose UE Security Capabilities IE differs from the values negotiated during the original UE registration.
Unexpected changes to ciphering or integrity algorithm selections for active UE sessions without a corresponding legitimate handover event.
PathSwitchRequest traffic originating from gNB identifiers not present in the operator's authorized gNB inventory.

Detection Strategies

Capture and inspect NGAP signaling on the N2 interface, correlating PathSwitchRequest payloads against the UE context recorded at initial registration.
Alert on any deviation between gNB-reported and core-stored UE Security Capabilities for the same Subscription Permanent Identifier (SUPI) or 5G-GUTI.
Baseline normal handover patterns and flag anomalous PathSwitchRequest rates or sources within the radio access network.

Monitoring Recommendations

Forward NGAP and AMF logs to a centralized analytics platform and retain UE context change events for forensic review.
Monitor gNB authentication and IPsec tunnel status on the N2 interface to identify rogue or unauthorized peers.
Track Ella Core version inventory across all 5G core nodes to confirm patched builds are deployed.

How to Mitigate CVE-2026-44475

Immediate Actions Required

Upgrade all Ella Core instances to version 1.10.0 or later, which adds verification of UE Security Capabilities in PathSwitchRequest handling.
Audit the list of gNBs permitted to establish NGAP associations with the core and remove any peers that are not strictly required.
Review recent NGAP traffic for PathSwitchRequest messages that may have altered UE security capabilities prior to patching.

Patch Information

The maintainers fixed this vulnerability in Ella Core 1.10.0. The fix introduces a comparison between the UE Security Capabilities supplied by the gNB in PathSwitchRequest and the values stored in the local UE context, rejecting mismatches. See the GitHub Security Advisory GHSA-pwfh-mqp3-pqwj for the full advisory.

Workarounds

Restrict the N2 interface to a dedicated management network and enforce IPsec with strong mutual authentication between gNBs and the core.
Limit physical and logical access to the radio access network to reduce the risk of rogue gNB deployment.
Where upgrade cannot be performed immediately, monitor NGAP traffic for unexpected PathSwitchRequest messages and disconnect suspect gNBs.

bash

# Configuration example
# Verify the deployed Ella Core version is 1.10.0 or later
ella-core --version

# Example: restrict N2/NGAP ingress to authorized gNB subnets only
iptables -A INPUT -p sctp --dport 38412 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP