free5GC NRF NF Registration Poisoning via Input Validation Failure

The free5GC Network Repository Function (NRF) exhibits a critical security vulnerability (CVE-2026-55068) in the RegisterNFInstance handler, which processes PUT requests at /nnrf-nfm/v1/nf-instances/{nfInstanceID}. The NRF accepts NF registration requests without performing input validation against mandatory 3GPP TS 29.510 constraints, including UUID formats, enum values, numeric ranges, and field requirements.

This lack of validation permits unauthenticated attackers to register arbitrary NF profiles, including those with attacker-controlled IP addresses and ports within the ipEndPoints parameter. Once registered, these malicious profiles are stored in the backend MongoDB and distributed to other network functions via the NFDiscover service. This leads to service mesh poisoning, where legitimate network functions like the SMF, AMF, or PCF are tricked into routing control-plane signaling to attacker-controlled endpoints. This vulnerability enables man-in-the-middle interception of sensitive 5G control-plane traffic, OAuth2 credential harvesting, and widespread denial-of-service conditions across the 5G core infrastructure.

Attack Chain

1. An attacker gains access to the Service-Based Architecture (SBI) network.
2. The attacker crafts a malicious JSON payload mimicking an NF registration request that violates multiple 3GPP constraints.
3. The attacker sends a PUT request to the NRF endpoint /nnrf-nfm/v1/nf-instances/ containing the forged nfInstanceId.
4. The NRF server accepts the invalid request and returns HTTP 201 without validating field integrity.
5. The NRF stores the fraudulent NF profile in its backend MongoDB collection.
6. A legitimate network function (e.g., SMF) queries the NRF for available NF instances using the NFDiscover API.
7. The NRF returns the malicious profile to the requester in the discovery response.
8. The legitimate NF selects the attacker-controlled endpoint and attempts to route control-plane signaling to the attacker's server.

Impact

Successful exploitation allows attackers to compromise the integrity of the entire 5G core service mesh. By redirecting control-plane signaling, an attacker can intercept subscriber traffic, harvest OAuth2 security credentials used for inter-service authentication, and cause systemic denial-of-service for connected subscribers. This vulnerability affects all components of the free5GC suite that rely on the NRF for service discovery, including AMF, SMF, AUSF, UDM, PCF, and NSSF. All versions of free5GC prior to 4.2.2 are vulnerable.

Recommendation

Prioritized actions for security and infrastructure teams:

• Upgrade all instances of free5GC to version 4.2.2 or later immediately to apply the patch for CVE-2026-55068.
• Implement a JSON schema validator for the MongoDB NfProfile collection to prevent the storage of malformed NF instances.
• Enable NRF auditing and logging; although logging does not prevent the attack, it provides the necessary telemetry to detect anomalous NF registration attempts.
• Implement strict ingress filtering and mTLS for the SBI interface to ensure that only authorized Network Functions can interact with the NRF registration endpoint.
• Deploy the provided Sigma rule to detect anomalous HTTP PUT registration requests at the NRF interface.