CVE-2026-55784: free5GC AUSF Race Condition Vulnerability

CVE-2026-55784 Overview

CVE-2026-55784 is a race condition vulnerability in free5GC, an open-source implementation of the 5G core network. The flaw resides in the Authentication Server Function (AUSF) component of version 1.4.4 and earlier. The AUSF stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool, keyed only by Subscription Permanent Identifier (SUPI). Concurrent authentication requests for the same SUPI unconditionally overwrite the active context, corrupting cryptographic state and denying authentication to the targeted subscriber. The weakness is classified as [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
An unauthenticated network-adjacent attacker with access to the AUSF Service-Based Interface (SBI) or N12 interface can persistently deny 5G authentication to any targeted subscriber by flooding concurrent authentication requests.

Affected Products

free5GC version 1.4.4
free5GC versions prior to 1.4.4
AUSF component (internal/context/context.go, internal/sbi/processor/ue_authentication.go)

Discovery Timeline

2026-08-28 - CVE-2026-55784 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55784

Vulnerability Analysis

The AUSF component maintains authentication state for User Equipment (UE) in a process-global sync.Map indexed by SUPI. Every incoming POST /nausf-auth/v1/ue-authentications request creates a new AusfUeContext and invokes AddAusfUeContextToPool, which executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext). The Store call is unconditional and provides no atomicity guarantees against parallel writes for the same key.

When multiple requests targeting the same SUPI arrive concurrently, each request generates its own authentication challenge material — K_aut, XRES, and EapID — but all requests share a single logical context URL. The later Store operations overwrite the state established by earlier ones. When a legitimate EAP-AKA' response returns for the earlier challenge, AUSF validates the AT_MAC against the current (overwritten) context. The MAC verification fails and authentication is denied, even though the response is cryptographically valid for the challenge originally issued.

Root Cause

The root cause is the absence of per-SUPI serialization or existence checks around authentication context creation. sync.Map.Store is thread-safe for map operations but does not enforce application-level invariants such as "do not replace an in-flight authentication context." The AUSF logic treats each request as independent and overwrites state without regard to pending EAP-AKA' exchanges.

Attack Vector

An attacker requires network reachability to the AUSF SBI/N12 interface, which is typically internal to a 5G operator's core network. The attacker sends a sustained flood of POST /nausf-auth/v1/ue-authentications requests specifying the SUPI of the targeted subscriber. Each attacker request overwrites the authentication context populated by the legitimate authentication attempt. The victim UE's EAP-AKA' response then fails AT_MAC verification against the mutated context, blocking network registration for the duration of the flood.

No authentication or user interaction is required to trigger the condition. The impact is limited to availability of the authentication service for the targeted subscriber; confidentiality and integrity are not directly affected.

Detection Methods for CVE-2026-55784

Indicators of Compromise

High volume of POST /nausf-auth/v1/ue-authentications requests targeting the same SUPI within a short window
Elevated rate of AT_MAC verification failures in AUSF logs for otherwise valid UE responses
Repeated authentication context replacements for identical SUPI values in AUSF telemetry
Failed 5G registration attempts correlated with SBI request bursts from a single or small set of source addresses

Detection Strategies

Instrument the AUSF to log every AddAusfUeContextToPool invocation with SUPI, source peer, and timestamp, then alert on duplicate SUPI stores within the EAP-AKA' round-trip window
Baseline normal nausf-auth request rates per subscriber and alert on statistical deviations
Correlate AUSF AT_MAC failures with concurrent SBI request patterns to identify targeted denial attempts

Monitoring Recommendations

Ingest AUSF, AMF, and SBI gateway logs into a centralized analytics platform with per-SUPI aggregation
Track authentication success rate as a service-level indicator and alert on per-subscriber failure spikes
Monitor N12 interface traffic for anomalous request concurrency from non-AMF peers

How to Mitigate CVE-2026-55784

Immediate Actions Required

Restrict access to the AUSF SBI and N12 interfaces to authorized AMF peers using network segmentation and mutual TLS
Deploy rate limiting on POST /nausf-auth/v1/ue-authentications at the SBI gateway, keyed by source peer and by target SUPI
Enable detailed AUSF audit logging and forward events to a SIEM for correlation
Track the GitHub Security Advisory GHSA-334q-h5g3-fpxv for fix availability

Patch Information

No fixed version is available as of this review. free5GC maintainers have published the advisory at GHSA-334q-h5g3-fpxv. Operators should monitor the free5GC repository for a release that introduces atomic context creation, per-SUPI locking, or rejection of duplicate in-flight authentication contexts.

Workarounds

Enforce strict peer authentication on the SBI so that only trusted AMF instances can invoke nausf-auth
Apply upstream rate limits and concurrency caps per SUPI at an API gateway or service mesh in front of the AUSF
Deploy a reverse proxy that rejects overlapping authentication requests for the same SUPI while a prior exchange is still pending
Increase monitoring sensitivity for authentication failure anomalies until an official patch is released

bash

# Example NGINX rate-limit configuration in front of the AUSF SBI
# Limits concurrent nausf-auth requests per client peer
limit_req_zone $binary_remote_addr zone=ausf_auth:10m rate=5r/s;

server {
    listen 8443 ssl http2;
    ssl_verify_client on;

    location /nausf-auth/v1/ue-authentications {
        limit_req zone=ausf_auth burst=10 nodelay;
        limit_conn_status 429;
        proxy_pass https://ausf_backend;
    }
}