Detections
Analytics
SCA: security update for github.com/free5gc/smf (GHSA-p9mg-74mg-cwwr)
high Tenable Cloud Security Plugin ID 441584
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the
UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE
/upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded
async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single
unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND
mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first).
This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by
name against any AN entry. This vulnerability is fixed in 4.2.2. (CVE-2026-44328)
Solution
Update the github.com/free5gc/smf library and its related packages to version 1.4.3 or later.See Also
Plugin Details
Severity: High
ID: 441584
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 5/9/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
Percentile: 96.46
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C
CVSS Score Source: CVE-2026-44328
CVSS v3
Risk Factor: High
Base Score: 8.2
Temporal Score: 7.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/8/2026
Vulnerability Publication Date: 5/8/2026
Reference Information
CVE: CVE-2026-44328