free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/…

CVE-2026-44330 affects free5GC, an open-source 5G core network implementation. Prior to version 4.2.2, the Network Exposure Function (NEF) mounts the nnef-pfdmanagement route group without proper OAuth2/bearer-token authorization. Network attackers who can reach NEF on the Service Based Interface (SBI) can use forged bearer tokens to read PFD application data and manipulate change-notification subscriptions. The vulnerability stems from missing inbound authentication middleware on the route group. This is a production-intended path that operators expect to be protected by OAuth2 but is not. The issue is fixed in version 4.2.2.