CVE-2026-40246 - Vulnerability Analysis

Overview

free5GC UDR service <= 1.4.2 contains an authorization bypass caused by improper validation of influenceId path segment in delete Traffic Influence Subscriptions handler, letting unauthenticated attackers delete arbitrary subscriptions via 5G Service Based Interface, exploit requires network access to the interface.

Severity & Score

Impact

Unauthenticated attackers can delete arbitrary Traffic Influence Subscriptions, disrupting network operations and service availability.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/free5gc/free5gc/security/advisories/GHSA-g9cw-qwhf-24jp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner