{"items":[{"id":"NVI-00018442","kind":"vulnerability","title":"free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cmpj-2x3g-m7g3","CVE-2026-44327"],"plain_summary":"GitHub lists this reviewed advisory for github.com/free5gc/nef. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-24656254d6a093c7fad1a13545a382f4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T23:48:22.000Z","value":"10 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-24656254d6a093c7fad1a13545a382f4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-24656254d6a093c7fad1a13545a382f4","url":"https://github.com/advisories/GHSA-cmpj-2x3g-m7g3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cmpj-2x3g-m7g3","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:50:36.189Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-24656254d6a093c7fad1a13545a382f4"],"technology":"github.com/free5gc/nef","known_exclusions":[],"conditions_summary":"### Summary\nfree5GC's NEF mounts the `nnef-oam` route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OAM route with no `Authorization` header at all and the handler returns `200 OK`. The current OAM handler is a stub that returns `null`, but the structural defect is route-group-scoped: the entire OAM route group has no inbound auth middleware, so every future OAM operation added to this group inherits the missing auth boundary by default. Same root cause as the NEF traffic-influence and PFD-management findings.\n\n### Details\nValidated against the NEF container in the official Docker compose lab.\n- Source repo tag: `v4.2.1`\n- Running Docker image: `free5gc/nef:v4.2.0`\n- Runtime NEF commit: `5ce35eab`\n- Docker validation date: 2026-03-11\n\nNEF advertises `OAuth2 setting receive from NRF: true`, yet the OAM route group is mounted without any inbound auth middleware and answers unauthenticated `GET`s with `200 OK`.\n\nCode evidence (paths in `free5gc/nef`):\n- OAM route group mounted without auth middleware: `NFs/nef/internal/sbi/server.go:60`\n- OAM route exposed at `/`: `NFs/nef/internal/sbi/api_oam.go:9`\n- OAM processor","public_affected_ranges":["<= 1.2.3"]}],"null_published_at":"2026-11-07T07:07:39.836Z","source_updated_at":"2026-06-08T23:48:22.000Z","source_disclosed_at":"2026-05-08T22:59:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:50:36.189Z"}],"next_cursor":null,"snapshot_revision":"42594"}