free5gc: Root CA Private Key Exposure (CVE-2026-115925)

The free5gc repository includes a hard-coded Root CA private key located at 'cert/root.key' and 'NFs/bsf/cert/root.key'. While the vulnerability is dormant in default configurations that use HTTP, the key becomes the active trust anchor for network function (NF) to network function (NF) mTLS when operators enable HTTPS to harden the Service Based Architecture (SBI). This allows an attacker to forge certificates and perform Man-in-the-Middle (MITM) attacks. No patches are currently available; remediation requires manual rotation of the CA.

Impact

Successful exploitation allows an attacker to gain full control over the PKI trust chain, facilitating the impersonation of any network function within the 5G core. This results in complete compromise of confidentiality and integrity for inter-NF traffic.

Recommendation

• Identify all free5gc deployments within your environment, specifically those configured to use HTTPS/mTLS for the Service Based Architecture (SBI).
• Immediately rotate the Root CA for all affected deployments; do not rely on the default keys provided in the source repository.
• Apply strict access control policies to the filesystem where the free5gc certificate store resides to prevent unauthorized extraction of the 'root.key' file.
• Implement a manual certificate rotation procedure that generates unique keys per deployment rather than utilizing the static key provided by the vendor.