Detections
Analytics
SCA: security update for github.com/free5gc/nef (GHSA-wqfh-gq79-j8mf)
high Tenable Cloud Security Plugin ID 446838
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the
nnef-callback route group without inbound OAuth2/bearer-token authorization. A forged or arbitrary bearer
token (e.g. Authorization: Bearer not-a-real-token) is enough to reach the SMF-callback handler -- the
callback body is parsed and dispatched into NEF business logic instead of being rejected at the auth
boundary. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound
auth middleware. NEF does not authenticate the producer NF identity before processing callback content; if
an attacker can guess or obtain a valid NotifId, this missing auth boundary lets forged callbacks act on
real subscription state. The route group is also reachable even when the runtime ServiceList does not
declare it (it lists only nnef-pfdmanagement and nnef-oam). This vulnerability is fixed in 4.2.2.
(CVE-2026-44320)
Solution
There is no known solution at this time.See Also
Plugin Details
Severity: High
ID: 446838
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/31/2026
Updated: 8/31/2026
Risk Information
VPR
Risk Factor: Medium
Score: 5.6
Percentile: 96.48
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-44320
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/8/2026
Vulnerability Publication Date: 5/8/2026
Reference Information
CVE: CVE-2026-44320