Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-40246: free5gc UDR lets attackers delete traffic subscriptions

CVE-2026-40246 · published 6 months ago

Summary

Versions of the free5gc UDR service up to 1.4.2 allow anyone on the 5G Service Based Interface to remove Traffic Influence Subscriptions, even though the system reports a "not found" error. This means an unauthenticated user could erase important subscription data without permission. Until a patch is released, limit network access to the UDR API and monitor for unexpected deletions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	free5gc	<= 1.4.2
Go	free5gc	github.com/free5gc/udr	<= 1.4.2
–	free5gc	free5gc	<= 1.4.2 `cpe:2.3:a:free5gc:free5gc::::::::`

Original advisory text

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execution continues and the subscription is deleted regardless. An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by supplying any value for the influenceId path segment, while the API misleadingly returns a 404 Not Found response. A patched version was not available at the time of publication.

References

https://github.com/advisories/GHSA-g9cw-qwhf-24jp
https://github.com/free5gc/udr Product
https://github.com/free5gc/free5gc/security/advisories/GHSA-g9cw-qwhf-24jp Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-40246 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40246... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-285Improper Authorization

Timeline

Published16 Apr 2026

Updated4 Nov 2026

First seen14 Apr 2026

Sources

GHSA-g9cw-qwhf-24jp · GHSA

CVE-2026-40246 · NVD

GHSA-g9cw-qwhf-24jp · OSV

CVE-2026-40246 · OSV

Track software like this

Free during beta