CVE-2026-47780 in free5GC
Summary
by MITRE • 09/15/2026
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing the identifier to pass validation and enter the normal create or query flow. The advisory does not independently establish whether authentication is required. Invalid identifiers can be persisted and retrieved as subscription records, enabling unauthorized data creation, UDR namespace pollution, persistent subscriber-metadata corruption, and interference with downstream components that trust stored identifiers to use valid 3GPP formats. The exposure is most relevant in lab, test, or loosely segmented service-based-interface deployments where direct UDR access is possible.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within free5GC versions 4.2.3 and earlier represents a critical input validation failure in the User Data Repository (UDR) component of this open-source 5G core network implementation. The flaw resides specifically in the HandleCreateEeSubscriptions and HandleQueryeesubscriptions functions located in the internal SBI API data repository module. These endpoints are responsible for managing subscription data related to event subscriptions, a fundamental aspect of service-based architecture interactions within the 5G ecosystem. The root cause is a deficiency in the regular expression used to validate the ueId path parameter. Instead of enforcing strict adherence to standardized 3GPP identifier formats such as SUPI (Subscription Permanent Identifier) or GPSI (Generic Public Subscription Identifier), the validation logic employs a regex pattern with a final alternative that accepts any non-empty string via a greedy match operator. This oversight allows an attacker to bypass structural integrity checks, effectively treating arbitrary strings as valid subscriber identifiers.
From a technical perspective, this constitutes a classic case of insufficient input validation leading to improper neutralization of special elements within data structures. By accepting non-3GPP compliant identifiers, the system fails to enforce expected format constraints before persisting or processing the data. An actor with network reachability to the UDR Service-Based Interface can exploit this by submitting requests containing malformed ueId values to endpoints such as /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions. Because the validation logic does not reject these inputs, they are processed through normal create or query flows. This behavior deviates significantly from secure coding practices that mandate strict schema enforcement for critical identifiers in telecommunications infrastructure. The advisory notes uncertainty regarding whether authentication is required to trigger this flaw, which implies potential exposure if deployed without robust access controls or in environments where network segmentation does not isolate the UDR from untrusted zones.
The operational impact of this vulnerability extends beyond simple data corruption. Invalid identifiers can be persisted within the UDR database and subsequently retrieved as legitimate subscription records. This leads to unauthorized data creation, effectively allowing an attacker to pollute the UDR namespace with malformed entries. Such pollution can interfere with downstream network functions that rely on the integrity of stored subscriber metadata. For instance, if other components trust these identifiers for routing or policy enforcement without re-validating their format, it could lead to misrouting of signaling messages, incorrect application of subscription policies, or even denial-of-service conditions as the system attempts to process invalid data structures. In a production environment, this corruption undermines the reliability and security posture of the entire 5G core network by compromising the trustworthiness of subscriber identity management.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-74 Injection in External Control of System or Configuration Objects. It also maps to MITRE ATT&CK techniques related to Data Manipulation, specifically T1608 Link Exploitation for Persistence if the corrupted data is used to maintain access, though primarily it represents a integrity violation through injection-like behavior into the database layer. The risk is most acute in laboratory, testing, or loosely segmented deployments where direct network access to the UDR SBI is possible without stringent firewall rules or mutual TLS authentication requirements typical of hardened production environments. Mitigation strategies should prioritize upgrading to patched versions that enforce strict regex patterns for SUPI and GPSI formats. Additionally, implementing robust input validation at multiple layers, including API gateways and WAFs, can provide defense in depth. Network segmentation is also critical; ensuring the UDR is only accessible from authorized network functions via secure channels significantly reduces the attack surface. Regular audits of subscription data integrity and monitoring for anomalous identifier patterns can further aid in detecting exploitation attempts before they cause significant disruption to core services.