CVE-2026-40247 - Vulnerability Analysis

Overview

free5GC UDR service <= 4.2.1 contains an information disclosure caused by improper handling of influenceId path segment in Traffic Influence Subscriptions, letting unauthenticated attackers read arbitrary subscription data via 5G Service Based Interface, exploit requires network access to the interface.

Severity & Score

Impact

Unauthenticated attackers can read sensitive subscriber data including SUPIs/IMSIs and callback URIs, risking privacy and data exposure.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/free5gc/free5gc/security/advisories/GHSA-x5r2-r74c-3w28

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner