CVE-2026-55068: free5GC NRF Information Disclosure Flaw

CVE-2026-55068 Overview

CVE-2026-55068 is an improper input validation vulnerability [CWE-20] in free5GC, an open-source implementation of the 5G core network. The flaw resides in the Network Repository Function (NRF) RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}. The handler accepts Network Function (NF) Profiles without validating UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. An attacker with Service Based Interface (SBI) access can register malicious profiles that are persisted in the MongoDB NfProfile collection and returned by NFDiscover. Versions 4.2.2 and earlier are affected, and the issue is fixed in version 4.2.3.

Critical Impact
An attacker with SBI access can advertise attacker-controlled network-function endpoints, redirect control-plane signaling, expose credentials, and deny service across NFs that trust the NRF.

Affected Products

free5GC versions 4.2.2 and earlier
free5GC NRF component versions prior to v1.4.5
5G core network deployments using free5GC NRF for service discovery

Discovery Timeline

2026-08-28 - CVE-2026-55068 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55068

Vulnerability Analysis

The NRF is the central service discovery and registration component in a 5G Service Based Architecture. Every Network Function such as AMF, SMF, UPF, AUSF, and UDM registers its profile with the NRF and queries it to locate peer NFs. The vulnerable RegisterNFInstance handler deserializes an incoming NF Profile JSON body into internal structures without enforcing the schema defined by 3GPP TS 29.510.

Because validation is absent, an attacker can submit profiles containing arbitrary nfInstanceID values, invalid nfStatus enum entries, out-of-range heartBeatTimer values, missing required fields, or attacker-controlled IP endpoints. These profiles are written directly to the MongoDB NfProfile collection. When legitimate NFs call NFDiscover, the poisoned entries are returned as valid discovery results.

Root Cause

The root cause is missing input validation on the NRF's registration path. Prior to v1.4.5, the handler passed the parsed nfprofile object to HandleNFRegisterRequest without schema enforcement, UUID checks, or enum verification. Trust in the NRF's returned discovery data is a foundational assumption for downstream NFs, so any tainted record propagates across the control plane.

Attack Vector

Exploitation requires network reachability to the NRF's SBI endpoint. An attacker who reaches the NRF submits a crafted PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} request registering a rogue NF whose ipEndPoints point to attacker infrastructure. Subsequent NF Discovery responses direct signaling to the attacker, enabling credential capture, signaling manipulation, integrity loss for service discovery, or denial of service.

// Patch excerpt: internal/sbi/api_nfmanagement.go
// Source: https://github.com/free5gc/nrf/commit/bda0cf75be5556bb4c758c8b34710f3fe6bbe3ea

		return
	}

-	s.Processor().HandleNFRegisterRequest(c, &nfprofile)
+	s.Processor().HandleNFRegisterRequest(c, &nfprofile, requestBody)
}

// UpdateNFInstance - Update NF Instance profile

The fix propagates the raw requestBody into the processor so concrete validation, including JSON Patch handling via github.com/evanphx/json-patch/v5, can enforce the profile schema before persistence. See the GitHub Security Advisory GHSA-x8mj-6p3q-g5pp for full context.

Detection Methods for CVE-2026-55068

Indicators of Compromise

MongoDB NfProfile documents containing malformed nfInstanceID values that do not conform to UUID format.
NF Profile entries with nfStatus values outside the 3GPP-defined enum, out-of-range heartBeatTimer, or missing mandatory fields.
nfServices.ipEndPoints referencing IP addresses or FQDNs outside the operator's expected NF address space.
Unexpected PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} requests originating from hosts that are not authorized NFs.

Detection Strategies

Audit the NfProfile MongoDB collection for schema conformance against 3GPP TS 29.510 and flag records failing UUID or enum checks.
Compare NFDiscover responses against an authoritative inventory of provisioned NFs and alert on new or unrecognized endpoints.
Instrument the NRF SBI ingress to log every RegisterNFInstance and UpdateNFInstance call with source IP, nfType, and endpoint list.

Monitoring Recommendations

Monitor for spikes in NF registration or update activity on the NRF, especially from previously unseen sources.
Alert when NFs suddenly resolve peers to IP endpoints outside the defined 5G core address ranges.
Track control-plane signaling volumes per NF pair to identify redirection to rogue endpoints.

How to Mitigate CVE-2026-55068

Immediate Actions Required

Upgrade free5GC to version 4.2.3 and the NRF component to v1.4.5 or later.
Restrict SBI network access to the NRF using network segmentation and mutual TLS so only authorized NFs can register.
Purge the MongoDB NfProfile collection of any entries that fail schema validation before returning the NRF to service.

Patch Information

The fix is delivered in free5GC v4.2.3 and free5GC NRF v1.4.5. Concrete validation for NF Profile create and patch operations was introduced in Pull Request #90 and commits bda0cf75 and fcd3cfaa. The patch adds JSON Patch handling and enforces UUID, enum, timer range, mandatory field, and IP endpoint constraints.

Workarounds

Place the NRF behind a Service Communication Proxy (SCP) or API gateway that validates NF Profile JSON against the 3GPP TS 29.510 schema before forwarding.
Enforce mutual TLS and client certificate allow-listing on the SBI to prevent unauthorized SBI callers from reaching the NRF.
Deploy MongoDB validators on the NfProfile collection to reject documents lacking UUID nfInstanceID, valid nfStatus, or well-formed ipEndPoints.

bash

# Example MongoDB collection validator to reject malformed NF Profiles
db.runCommand({
  collMod: "NfProfile",
  validator: {
    $jsonSchema: {
      bsonType: "object",
      required: ["nfInstanceId", "nfType", "nfStatus"],
      properties: {
        nfInstanceId: {
          bsonType: "string",
          pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        nfStatus: { enum: ["REGISTERED", "SUSPENDED", "UNDISCOVERABLE"] },
        heartBeatTimer: { bsonType: "int", minimum: 1, maximum: 3600 }
      }
    }
  },
  validationLevel: "strict"
})