CVE-2026-55068: free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
free5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers.
References
- github.com/advisories/GHSA-x8mj-6p3q-g5pp
- github.com/free5gc/free5gc/issues/1056
- github.com/free5gc/free5gc/releases/tag/v4.2.3
- github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp
- github.com/free5gc/nrf/commit/bda0cf75be5556bb4c758c8b34710f3fe6bbe3ea
- github.com/free5gc/nrf/commit/fcd3cfaa27cc4dc17172ee0c4c3e0a3a696297c6
- github.com/free5gc/nrf/pull/90
- github.com/free5gc/nrf/releases/tag/v1.4.5
- nvd.nist.gov/vuln/detail/CVE-2026-55068
Code Behaviors & Features
Detect and mitigate CVE-2026-55068 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →