free5GC advisories detail two unpatched 5G core flaws

Two security advisories from the free5GC project detail two unpatched vulnerabilities in its 5G core that have published proof-of-concept material. The more severe issue, CVE-2026-115926, scores 9.1 on CVSS v3.1 and relates to the Binding Support Function (BSF) operating without authentication. The other, CVE-2026-115925, scores 8.7 and concerns an unencrypted Root CA private key embedded in the repository, capable of signing network function certificates.

As of 28 October 2026, neither flaw has a patched release, and there is no confirmed exploitation reported. The advisories describe how the BSF’s unauthenticated management API could allow reading, creating, altering or deleting subscriber bindings, enabling control over QoS, charging and traffic gating by redirecting bindings to a rogue PCF. The Root CA key exposure could permit forged certificates and impersonation of core services, though a man‑in‑the‑middle position would be required for practical use.

Affected versions are listed as free5GC BSF up to commit 1754bde, shipped with free5GC v4.2.3 for CVE-2026-115926, and free5GC v1.0.0 through v4.2.3 and later for CVE-2026-115925. Mitigations are described as workarounds pending fixes: for the BSF, restrict access to its service port to trusted core functions or disable the optional BSF if unused; for the root CA key, generate a new root CA and re-sign all network function certificates, and never use the bundled key in a live deployment.

Both advisories indicate no confirmed exploitation to date, and operators are advised to monitor vendor advisories for patches. The report attributes these details to the free5GC project advisories and related GitHub notes.