Missing authentication on PFD-management API in free5GC NEF (CVE-2026-44315)

free5GC's Network Exposure Function (NEF) mounts the `3gpp-pfd-management` route group without inbound OAuth2/bearer-token authorization, accepting arbitrary or forged bearer tokens. An attacker with network access to the NEF Service Based Interface (SBI) can create, read, and delete PFD transaction state, enabling policy poisoning in UDR, disclosure of AF-supplied policy data, and denial of service to provisioned application detection rules. The vulnerable route group remains reachable even when the operator's `ServiceList` configuration does not declare it, rendering that mitigation ineffective. Affected versions: - <= v4.2.1 We recommend updating to: v4.2.2. CVSS 9.4 · our assessment: act_now Reference: https://github.com/free5gc/free5gc/security/advisories/GHSA-5f62-53r8-qrqf Details: https://vuln.today/cve/CVE-2026-44315