{"vulnerability": "CVE-2026-55068", "sightings": [{"uuid": "cd7ad2a9-a359-4704-9301-ee494b3bc753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55068", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mua2k3cq6i2e", "content": "CVE-2026-55068 - github.com/free5gc/free5gc\nVersions of free5GC up to 4.2.2 let anyone with access to the internal API add false network function records without proper validation. These bogus entries are\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#free5gc #Golang #CVE #infosec", "creation_timestamp": "2026-08-29T14:10:04.046140Z"}, {"uuid": "34a24196-b4b6-4ae9-8bbf-d0e51faa2191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55068", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu6er5jzmv2c", "content": "\ud83d\udea8 CVE-2026-55068 \u2014 CVSS 9.3 CRITICAL\n\nfree5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFIn...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-55068\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-28T22:07:40.035956Z"}, {"uuid": "4ba6f47a-555d-4dc5-a923-9e0a83ffb7ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55068", "type": "seen", "source": "https://gist.github.com/alon710/6afc3d410daf4fc14ca37ccd754d5535", "content": "# CVE-2026-55068: CVE-2026-55068: Network Function Registration Poisoning in free5GC NRF\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55068\n\n## Summary\nImproper input validation in the free5GC Network Repository Function (NRF) enables attackers with Service-Based Interface (SBI) access to register poisoned Network Function (NF) profiles, facilitating control-plane redirection and credential sniffing.\n\n## TL;DR\nUnauthenticated remote attackers can register malformed NF profiles to redirect legitimate 5G control-plane signaling to attacker-controlled endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20 (Improper Input Validation)\n- **Attack Vector**: Network (SBI access)\n- **CVSS v4.0**: 9.3\n- **Impact**: Control-Plane Redirect / Information Disclosure / Denial of Service\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- free5GC Core v4.2.2 and earlier\n- free5GC NRF Component v1.4.4 and earlier\n- **free5GC**: <= 4.2.2 (Fixed in: `4.2.3`)\n- **NRF (Network Repository Function)**: <= 1.4.4 (Fixed in: `1.4.5`)\n\n## Mitigation\n\n- Upgrade the free5GC core platform to version v4.2.3 or higher.\n- Isolate the NRF microservice and update its binary component to version v1.4.5 or higher.\n- Implement mutual TLS (mTLS) authentication across the Service-Based Interface (SBI) to verify the identities of registering NFs.\n- Utilize Network Policies (Kubernetes NetPol) to strictly limit network communication to the NRF REST port (typically TCP 8000).\n\n**Remediation Steps:**\n1. Stop the running free5GC NRF process or tear down its container.\n2. Update the free5GC configuration and pull NRF component code from version 1.4.5 or later.\n3. Recompile the NRF binary using Go v1.21+ to incorporate the newly defined `nf_profile_validation.go` module.\n4. Verify the validation changes by attempting to send a malformed PUT profile with a non-UUID instance identifier and confirming that the server responds with an HTTP 400 Bad Request.\n\n## References\n\n- [GHSA-x8mj-6p3q-g5pp Security Advisory](https://github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp)\n- [GitHub Issue 1056: NF Profile Validation Flaw](https://github.com/free5gc/free5gc/issues/1056)\n- [free5GC Core v4.2.3 Release Notes](https://github.com/free5gc/free5gc/releases/tag/v4.2.3)\n- [free5GC NRF v1.4.5 Release Notes](https://github.com/free5gc/nrf/releases/tag/v1.4.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55068) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T17:33:07.263962Z"}, {"uuid": "e243dcb2-b6dd-40ae-9e0b-73e64c41dfd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55068", "type": "published-proof-of-concept", "source": "https://github.com/free5gc/free5gc/security/advisories/GHSA-x8mj-6p3q-g5pp", "content": "", "creation_timestamp": "2026-08-28T18:35:23.920963Z"}]}