# free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

free5GC SMF's unauthenticated UPI DELETE handler mutates user-plane topology then nil-derefs UPF on AN nodes, panicking and denying UPF selection.

- Payout: Research
- Severity: high
- Program: free5GC
- Found by: LinZiyuu
- Disclosed: 2026-05-08
- CVE: CVE-2026-44328
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-p9mg-74mg-cwwr
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr
- Tags: area:devices domain:infra domain:network impact:dos impact:integrity kind:research platform:ghsa sev:high tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:dos vuln:misconfiguration

**Target:** SMF SBI UPI management endpoint (DELETE /upi/v1/upNodesLinks/{ref})
**Root cause:** UPI route group is mounted without OAuth2 middleware, and DeleteUpNodeLink calls upNode.UPF.CancelAssociation() unconditionally after a type guard that only covers the async release; AN-typed nodes have a nil UPF by construction.
**Steps:**
1. Control: `curl -i http://10.100.200.6:8000/nsmf-oam/v1/` returns `401 Unauthorized`, proving auth middleware exists on other groups.
2. Trigger: `curl -i -X DELETE http://10.100.200.6:8000/upi/v1/upNodesLinks/gNB1` with no token.
3. Observe `500 Internal Server Error`; container logs show `UPNode [gNB1] found. Deleting it.` and `Delete UPLink [UPF] <=> [gNB1].` before `panic: runtime error: invalid memory address or nil pointer dereference` at `api_upi.go:99`.
4. Topology mutation persists after panic; repeat against any AN entry name.
**How found:** Noticed the UPI route group mounted without OAuth middleware while sibling nsmf-oam returns 401, then code-read the delete handler and saw the Type==UPNODE_UPF guard only wraps the async release while CancelAssociation runs unconditionally on AN nodes constructed without a UPF.
**Exploitation:** Any off-path attacker reaching SMF on the SBI sends a single unauthenticated DELETE naming an AN entry (e.g. gNB1). UpNodeDelete mutates in-memory user-plane topology first, then the nil UPF dereference panics the handler goroutine (Gin recovers). Repeating by name sustains topology denial, preventing SMF from considering that AN/UPF in UPF selection and PFCP path establishment for legitimate UE sessions.
**Escalation:** Strict superset of the broader UPI auth gap (#887): same missing auth plus request-triggerable nil deref plus state mutation surviving the panic; repeatable against arbitrary AN entries.
**Insight:** When a type guard wraps only an async call, check what runs after it on the same object; and compare auth behavior across sibling route groups on the same server (401 vs 500) to spot groups mounted without middleware.

## Proof of concept (copied exactly from the original report)

**Unauthenticated DELETE request crashing SMF on AN node**

```
curl -i -X DELETE http://10.100.200.6:8000/upi/v1/upNodesLinks/gNB1
HTTP/1.1 500 Internal Server Error
```

**Control request showing protected sibling returns 401**

```
curl -i http://10.100.200.6:8000/nsmf-oam/v1/
HTTP/1.1 401 Unauthorized
```