CVE-2026-40245: 
vulnerability analysis and mitigation

CVE-2026-40245 is an unauthenticated information disclosure vulnerability in the UDR (Unified Data Repository) service of Free5GC, an open-source Linux Foundation 5G mobile core network implementation. It affects Free5GC versions 4.2.1 and below (Go package github.com/free5gc/udr <= 1.4.2). The vulnerability was published on April 14, 2026, and reviewed by the National Vulnerability Database on April 16, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, free5gc Advisory).

The root cause is a missing return statement in the HandleApplicationDataInfluenceDataSubsToNotifyGet function in NFs/udr/internal/sbi/api_datarepository.go (around line 2793). When the handler detects that all required query parameters (dnn, snssai, internalGroupId, supi) are absent, it correctly sends an HTTP 400 response via c.JSON(http.StatusBadRequest, problemDetails), but fails to return — allowing execution to fall through into ApplicationDataInfluenceDataSubsToNotifyGetProcedure, which queries the data repository and appends the full list of Traffic Influence Subscriptions (including SUPI/IMSI values) to the already-sent response body. A second bypass exists when a malformed snssai parameter is provided, triggering the same missing-return pattern in the deserialization error branch. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-202 (Exposure of Sensitive Information Through Data Queries), and CWE-209 (Generation of Error Message Containing Sensitive Information) (GitHub Advisory).

An unauthenticated attacker with network access to the 5G Service Based Interface (SBI) can retrieve the complete list of stored SUPI (Subscriber Permanent Identifier) / IMSI values for all registered subscribers with a single HTTP GET request. The SUPI is the most sensitive subscriber identifier in 5G networks; its exposure directly undermines the privacy guarantees of the 3GPP SUCI (Subscription Concealed Identifier) concealment mechanism, which was specifically designed to prevent subscriber tracking over the air. Any Free5GC deployment where the SBI is reachable by untrusted parties — due to misconfigured network segmentation, a rogue network function, or a compromised internal host — is at risk of full subscriber identity enumeration (free5gc Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, consisting of a single curl command requiring no authentication or prior knowledge of any subscriber identifier. No credentials, special tools, or complex setup are required to reproduce the vulnerability. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.047% (0.00126 raw), placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA KEV catalog (free5gc Advisory, GitHub Advisory).

1. Reconnaissance: Identify Free5GC UDR instances accessible on the network, particularly those with the 5G Service Based Interface (SBI) exposed. Scan for HTTP services on standard SBI ports using tools like nmap or curl.
2. Confirm target: Verify the UDR endpoint is reachable by sending a test request to the target host.
3. Send parameterless GET request: Issue a single HTTP GET request to the vulnerable endpoint with no query parameters:

   curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify"

4. Receive leaked data: The server responds with HTTP 400, but the response body contains both the error message and the full list of Traffic Influence Subscriptions including SUPI/IMSI values:

   {"status":400,"detail":"At least one of DNNs, S-NSSAIs, Internal Group IDs or SUPIs shall be provided"}
   [{"dnns":["internet"],"snssais":[{"sst":1,"sd":"000001"}],"supis":["imsi-222777483957498"],"notificationUri":"http://pcf.../npcf-callback/v1/nudr-notify/influence-data/imsi-222777483957498/1"}]

5. Alternative trigger: Send a request with a malformed snssai parameter to trigger the deserialization error bypass, which produces the same information disclosure.
6. Enumerate subscribers: Parse the response body to extract all SUPI/IMSI values for further subscriber tracking or targeted attacks (free5gc Advisory).

• Network: HTTP GET requests to /nudr-dr/v2/application-data/influenceData/subs-to-notify with no query parameters or a malformed snssai parameter originating from unexpected or untrusted source IPs on the SBI network.
• Logs: UDR access logs showing HTTP 400 responses to the above endpoint from sources outside of known authorized network functions; repeated requests from the same IP in a short timeframe suggesting automated enumeration.
• Response Anomaly: HTTP 400 responses from the UDR endpoint that contain a non-empty body with subscriber data (SUPI/IMSI values) alongside the error message — a normal patched system returns only the error JSON with no subscriber data (free5gc Advisory).

The vulnerability is patched by adding two missing return statements in NFs/udr/internal/sbi/api_datarepository.go within the HandleApplicationDataInfluenceDataSubsToNotifyGet function — one after the snssai deserialization error handler and one after the empty parameters validation block. Users should upgrade Free5GC beyond version 4.2.1 as soon as a patched release is available. As an immediate workaround, restrict network access to the 5G SBI to only trusted, authorized network functions using network segmentation, firewall rules, or access control lists. Additionally, monitor UDR access logs for anomalous parameterless requests to the affected endpoint (free5gc Advisory, GitHub Advisory).

The vulnerability was reported by security researchers Giancannella and FrancescoDAlterio and published by Alonza0314 on behalf of the free5gc project on April 14, 2026. The advisory was picked up by several vulnerability tracking services including VulDB, CVEFeed, and INCIBE-CERT shortly after publication. Social media activity was observed on Bluesky via automated CVE tracking accounts. No major vendor statements or notable researcher commentary beyond the original advisory have been identified (free5gc Advisory).