{"id":"GHSA-6rgm-gr97-x3j5","revision":"cdab11ac72b245c68564a8e0b3fdc15a","records":[{"revision":"cdab11ac72b245c68564a8e0b3fdc15a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-6rgm-gr97-x3j5","aliases":["CVE-2026-42083","GO-2026-5189"],"title":"Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI","description":"### Summary\nPCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI\n### Details\nIn `NewServer()`, the `smPolicyGroup` route group is created and routes are applied without attaching the router authorization middleware. In contrast, other PCF service groups such as `Npcf_PolicyAuthorization` do attach `RouterAuthorizationCheck` before route registration.\n\nBecause the middleware is missing, requests to the following endpoints can reach business logic even when no valid OAuth token is provided:\n\n- `POST /npcf-smpolicycontrol/v1/sm-policies`\n- `GET /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}`\n- `POST /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/update`\n- `POST /npcf-smpolicycontrol/v1/sm-policies/{smPolicyId}/delete`\n\nThis is visible at runtime because unauthenticated requests return business-level responses such as `400` or `404` instead of being rejected with `401` before handler execution. Under valid lab preconditions (existing UE/session context and related policy data), unauthenticated `POST /sm-policies` can succeed with `201`, and unauthenticated `GET /sm-policies/{id}` can succeed with `200` and return policy context containing subscriber identifiers including `supi`.\n\nThe root cause is missing router auth enforcement for `Npcf_SMPolicyControl`. \nUpstream also fixed this by adding `RouterAuthorizationCheck` to `smPolicyGroup` (and `uePolicyGroup`) in free5gc/pcf PR #63.\n\n### PoC\n1. Deploy free5GC with PCF reachable on the SBI network.\n2. Use the PoC against the PCF service **without** an `Authorization` header:\n   ```bash\n   go run /home/ubuntu/free5gc/tools/npcf-smpolicy-noauth-poc/main.go \\\n     --pcf-root /home/ubuntu/free5gc/NFs/pcf \\\n     --pcf-url http://10.100.200.9:8000 \\\n     --timeout 4s\nObserve that unauthenticated requests to Npcf_SMPolicyControl return business responses instead of 401.\n### Impact\n\nThis is an authentication/authorization bypass on a network-accessible SBI service. Any unauthenticated actor able to reach the PCF SBI interface can invoke Npcf_SMPolicyControl handlers directly.","state":0,"publishedAt":"2026-05-07T01:58:42+00:00","modifiedAt":"2026-06-25T19:56:20.3210154+00:00","affected":[{"ecosystem":"Go","name":"github.com/free5gc/pcf","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-6rgm-gr97-x3j5","https://nvd.nist.gov/vuln/detail/CVE-2026-42083","https://github.com/free5gc/free5gc/issues/844","https://github.com/free5gc/pcf/pull/63","https://github.com/free5gc/pcf/commit/8c4d457cdf58bb239ee30e88c56b370b22073964","https://github.com/free5gc/free5gc"],"sourceUrl":"https://github.com/advisories/GHSA-6rgm-gr97-x3j5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6rgm-gr97-x3j5","identifiers":["GHSA-6rgm-gr97-x3j5","CVE-2026-42083","GO-2026-5189"]},"retained":false,"historicalAffected":[]}],"coverage":[]}