Missing authentication middleware on UPI route group in free5GC SMF (CVE-2026-44329)

The SMF component of free5GC mounts its UPI management route group without OAuth2/bearer-token authorization middleware, allowing any network attacker with access to the SMF Service-Based Interface to invoke UPI endpoints without an Authorization header. Unauthenticated attackers can read the UP-plane topology, inject attacker-controlled UPF node and link entries poisoning SMF's UPF selection logic, and issue delete operations against named UPF entries, disrupting legitimate PDU session establishment. Affected versions: - <= v4.2.1 We recommend updating to: v4.2.2. CVSS 10.0 · our assessment: act_now Reference: https://github.com/free5gc/free5gc/security/advisories/GHSA-3258-qmv8-frp3 Details: https://vuln.today/cve/CVE-2026-44329