CVE-2026-78158: Open5GS AMF Authentication Bypass Flaw

CVE-2026-78158 Overview

CVE-2026-78158 is an improper authorization vulnerability in Open5GS 2.8.0, an open-source implementation of 5G Core and EPC. The flaw resides in the AMF UEContextReleaseRequest path handler within the Access and Mobility Management Function (AMF) component. An attacker with low privileges can remotely manipulate the release request path to bypass authorization checks. The issue is tracked under CWE-266: Incorrect Privilege Assignment and has been assigned a low severity rating. Additional technical context is available in the GitHub Security Advisory GHSA-mg8r-2cvv-xq9j and the VulDB entry for CVE-2026-78158.

Critical Impact
Remote attackers with low privileges can trigger improper authorization in Open5GS AMF, potentially causing unauthorized UE context releases that disrupt subscriber sessions in 5G Core deployments.

Affected Products

Open5GS 2.8.0
Open5GS AMF component (UEContextReleaseRequest path handler)
5G Core deployments built on the affected Open5GS release

Discovery Timeline

2026-08-24 - CVE-2026-78158 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78158

Vulnerability Analysis

The vulnerability affects the AMF UEContextReleaseRequest path handler in Open5GS 2.8.0. The AMF governs signaling for User Equipment (UE) registration, mobility, and connection management within a 5G Core network. The UEContextReleaseRequest procedure is issued over the N2 interface between the gNB and the AMF to signal that a UE context should be released.

According to the GitHub Security Advisory GHSA-mg8r-2cvv-xq9j, the affected code path performs insufficient authorization validation when processing manipulated release requests. An authenticated adversary with network reachability to the AMF can leverage the flaw to perform actions outside the privileges assigned to their role, mapping to CWE-266.

The EPSS data for this CVE indicates a low near-term probability of exploitation, and no proof-of-concept or in-the-wild exploitation has been confirmed at the time of publication.

Root Cause

The root cause is incorrect privilege assignment in the handler that processes UEContextReleaseRequest messages. The path performs an action based on message-supplied identifiers without adequately verifying that the requester holds authorization for the target UE context.

Attack Vector

Exploitation requires network access to the AMF signaling interface and low-level authenticated privileges. No user interaction is required. A remote attacker submits a manipulated UEContextReleaseRequest that the AMF processes without proper authorization checks, resulting in limited impact to confidentiality, integrity, and availability of the affected UE session state.

No verified public exploit code is available. Refer to the Open5GS GitHub repository and the linked security advisory for source-level details.

Detection Methods for CVE-2026-78158

Indicators of Compromise

Unexpected UEContextReleaseRequest messages targeting UE identifiers not associated with the originating peer.
AMF log entries showing successful context release operations for UEs that did not initiate a release.
Abnormal session termination patterns across subscribers on the 5G Core.

Detection Strategies

Enable verbose AMF logging in Open5GS and audit UEContextReleaseRequest handling for unusual source peers or malformed parameters.
Correlate N2 signaling events with subscriber session state changes to identify unauthorized release activity.
Deploy anomaly detection on control-plane traffic between gNBs and the AMF to flag deviations from baseline release request rates.

Monitoring Recommendations

Monitor Open5GS AMF process logs for authorization decisions related to UE context management.
Track counts of UE context releases per gNB and per AMF to identify statistical outliers.
Forward 5G Core control-plane telemetry to a centralized analytics platform for retention and threat hunting.

How to Mitigate CVE-2026-78158

Immediate Actions Required

Inventory all Open5GS deployments and identify systems running version 2.8.0.
Restrict network reachability to the AMF signaling interfaces to trusted gNBs and management hosts only.
Enforce strict authentication and mutual TLS on N2 and service-based interfaces where supported.
Review AMF logs for prior indicators of manipulated UEContextReleaseRequest traffic.

Patch Information

At the time of publication, monitor the Open5GS GitHub repository and the GitHub Security Advisory GHSA-mg8r-2cvv-xq9j for the fixed release and upgrade instructions. Apply the vendor-provided update as soon as it is available and validate the fix in a staging environment before rolling out to production 5G Core nodes.

Workarounds

Segment the 5G Core control plane on a dedicated network reachable only by authorized gNBs and OSS/BSS systems.
Apply firewall or service mesh policies that filter unauthorized peers from initiating N2 signaling to the AMF.
Increase logging verbosity on the AMF and forward events to a SIEM for detection of manipulated release requests.
Rotate credentials and certificates used by any element permitted to signal the AMF following a suspected exposure.

bash

# Example: restrict AMF N2 interface to trusted gNB subnets using iptables
iptables -A INPUT -p sctp --dport 38412 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP