Missing authentication on traffic-influence API in free5GC NEF (CVE-2026-44326)

The Network Exposure Function (NEF) in free5GC mounts the `3gpp-traffic-influence` API without inbound OAuth2/bearer-token authorization, allowing any network-reachable party to create, read, patch, and delete traffic-influence subscriptions using no Authorization header or a forged bearer token. Successful exploitation enables unauthenticated creation of group/any-UE traffic-steering subscriptions, modification of live traffic-steering policy, and denial of service to legitimate subscriptions via deletion. The affected route group remains reachable even when the operator's `ServiceList` configuration does not declare the service, rendering that configuration control ineffective. Affected versions: - <= v4.2.1 We recommend updating to: v4.2.2. CVSS 9.4 · our assessment: act_now Reference: https://github.com/free5gc/free5gc/security/advisories/GHSA-3p28-73q7-45xp Details: https://vuln.today/cve/CVE-2026-44326