Answer in brief
CVE-2026-55068 records a Critical severity (CVSS 0.0) vulnerability in free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints. The current sources do not mark it as known exploited. The current feed maps free5gc/free5gc (generic), github.com/free5gc/free5gc (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 0.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps free5gc/free5gc (generic), github.com/free5gc/free5gc (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| free5gc/free5gcgeneric | < 4.2.3 | Not reported |
| github.com/free5gc/free5gcgo | <4.2.2 | 4.2.2 |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile collection and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled network-function endpoints and redirect control-plane signaling. This can expose credentials and signaling, alter service discovery integrity, and deny service across network functions that trust the NRF. This issue is fixed in version 4.2.3.
Quoted source text, attributed separately from HOL analysis.