CVE-2026-86212: Open5GS AMF/MME Auth Bypass Vulnerability

CVE-2026-86212 Overview

CVE-2026-86212 is an improper authorization vulnerability [CWE-266] in Open5GS versions 2.7.7 and 2.8.0. The flaw resides in the Access and Mobility Management Function (AMF) and Mobility Management Entity (MME) components, which handle UE (User Equipment) signaling in 4G/5G core networks. The vulnerability allows a remote, authenticated attacker with low privileges to trigger improper authorization during partial NG-Reset handling. Public disclosure has occurred, and a patch is available in commit 9468de94caed2fc940f4a23cbf734651896d0fde. Open5GS is widely deployed as an open-source 5G/LTE core, making the flaw relevant for telecom operators, researchers, and private 5G deployments.

Critical Impact
An authenticated adversary on the network can cause the AMF/MME to act on UE contexts that do not belong to the requesting gNB, potentially disrupting subscriber sessions handled by other radio nodes.

Affected Products

Open5GS 2.7.7
Open5GS 2.8.0
Deployments using the AMF/MME components from the affected releases

Discovery Timeline

2026-09-06 - CVE-2026-86212 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86212

Vulnerability Analysis

The vulnerability affects how the Open5GS AMF and MME handle partial NG-Reset procedures over the NGAP interface. During a partial reset, the core function processes a list of UE-NGAP-ID pairs supplied by a gNB. Prior to the patch, the code did not verify that the referenced ran_ue context actually belonged to the requesting gNB, nor did it validate that the supplied RAN_UE_NGAP_ID matched the stored value for the associated AMF_UE_NGAP_ID. A gNB submitting a partial reset request could therefore influence UE contexts owned by different gNBs, producing an authorization boundary violation between radio access nodes served by the same core.

Root Cause

The root cause is missing ownership and consistency checks on UE association identifiers in src/amf/ngap-handler.c and src/amf/nsmf-handler.c. The handler dereferenced ran_ue after basic assertions but did not cross-check ran_ue->gnb_id against the current gnb->id, nor confirm that the message's rAN_UE_NGAP_ID matched ran_ue->ran_ue_ngap_id. This maps to CWE-266 (Incorrect Privilege Assignment) because a low-privileged peer can influence resources outside its authorization scope.

Attack Vector

Exploitation requires network access and a low level of privilege, meaning an attacker must be able to communicate with the AMF/MME as a gNB peer over NGAP. From that position, the attacker crafts a partial NG-Reset message referencing UE-NGAP-ID pairs that belong to another gNB. The unpatched core accepts the request and marks those UE contexts as part of the reset, leading to session state manipulation across trust boundaries.

// Security patch in src/amf/ngap-handler.c
ogs_assert(ran_ue);

if (ran_ue->gnb_id != gnb->id) {
    ogs_error("AMF_UE_NGAP_ID[%lld] does not belong to this gNB "
            "[UE:gNB-ID:%llu, Message:gNB-ID:%llu]",
            (long long)ran_ue->amf_ue_ngap_id,
            (unsigned long long)ran_ue->gnb_id,
            (unsigned long long)gnb->id);
    continue;
}

if (item->aMF_UE_NGAP_ID && item->rAN_UE_NGAP_ID &&
        ran_ue->ran_ue_ngap_id != *item->rAN_UE_NGAP_ID) {
    ogs_error("Invalid RAN_UE_NGAP_ID[%lld] for "
            "AMF_UE_NGAP_ID[%lld] [expected:%lld]",
            (long long)*item->rAN_UE_NGAP_ID,
            (long long)ran_ue->amf_ue_ngap_id,
            (long long)ran_ue->ran_ue_ngap_id);
    continue;
}

/* RAN_UE Context where PartOfNG_interface was requested */
ran_ue->part_of_ng_reset_requested = true;

Source: Open5GS commit 9468de94

Detection Methods for CVE-2026-86212

Indicators of Compromise

Repeated ogs_error log entries referencing AMF_UE_NGAP_ID mismatches or Invalid RAN_UE_NGAP_ID values on patched instances, indicating a peer submitting inconsistent identifiers.
NGAP partial reset messages arriving from a gNB but referencing UE-NGAP-ID pairs previously associated with a different gNB.
Unexpected part_of_ng_reset_requested state changes on UE contexts not associated with the initiating gNB.

Detection Strategies

Enable verbose AMF/MME logging and alert on error messages produced by the new validation branches introduced in commit 9468de94.
Correlate NGAP NG Reset messages with the originating SCTP association and confirm the gNB identity matches the referenced UE contexts.
Baseline the frequency of partial reset requests per gNB and flag deviations that may indicate abuse of the authorization gap.

Monitoring Recommendations

Ingest AMF/MME logs and NGAP traffic metadata into a centralized analytics platform for cross-node correlation.
Monitor SCTP peer identities and reject or alert on unauthorized gNB associations to the core.
Track subscriber session churn to detect abnormal drops or resets that correlate with suspicious NGAP activity.

How to Mitigate CVE-2026-86212

Immediate Actions Required

Upgrade Open5GS to a build that includes commit 9468de94caed2fc940f4a23cbf734651896d0fde or later.
Audit which gNBs are permitted to establish NGAP/SCTP associations with the AMF and MME, and remove any untrusted peers.
Review AMF/MME logs for prior instances of malformed or cross-gNB partial reset requests.

Patch Information

The fix is available in the upstream Open5GS repository as commit 9468de94caed2fc940f4a23cbf734651896d0fde, which adds validation of UE associations during partial reset in src/amf/ngap-handler.c and src/amf/nsmf-handler.c. See the Open5GS commit details and the associated GitHub issue #4680 for the full change set.

Workarounds

Restrict NGAP/SCTP connectivity to the AMF/MME using network ACLs so that only authorized gNBs can reach the core signaling ports.
Deploy IPsec or equivalent transport-layer protection between gNBs and the core, as recommended by 3GPP, to prevent unauthenticated peers from injecting NGAP messages.
Segment the operations network so that lab or third-party gNBs cannot reach production AMF/MME instances.

bash

# Verify installed Open5GS version and confirm patch presence
open5gs-amfd -v
cd /path/to/open5gs && git log --oneline | grep 9468de94

# Example: restrict NGAP (SCTP/38412) to trusted gNB subnets
iptables -A INPUT -p sctp --dport 38412 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP