Is there a public PoC exploit available for CVE-2026-8122?

Yes, a public proof-of-concept exploit is available for CVE-2026-8122. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8122

Q: What is the CVSS score of CVE-2026-8122?

CVE-2026-8122 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28480 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-08 VulDB

GHSA-ghx3-pgmg-h9fc

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 01:30 vuln.today

Severity Changed

May 08, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

May 08, 2026 - 01:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 08, 2026 - 00:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in Open5GS up to 2.7.7. This affects the function ogs_sbi_discovery_option_add_service_names in the library /lib/sbi/message.c of the component NSSF. The manipulation results in denial of service. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service vulnerability in Open5GS up to version 2.7.7 affects the NSSF component's service discovery function, allowing remote authenticated attackers to cause availability impact through manipulation of the ogs_sbi_discovery_option_add_service_names function. Public exploit code exists and the vulnerability carries low CVSS score (2.1) reflecting limited impact scope, though the project has not yet responded to early notification.

Technical ContextAI

The vulnerability exists in the NSSF (Network Slice Selection Function) component within Open5GS's Service Based Interface (SBI) message handling library, specifically in the ogs_sbi_discovery_option_add_service_names function located in /lib/sbi/message.c. This function is responsible for adding service names during SBI service discovery operations. The root cause is classified as CWE-404 (Improper Resource Validation), indicating the function fails to properly validate or handle resource parameters during service name addition, resulting in denial of service conditions. The SBI is a key northbound interface in 5G core networks used for inter-service communication.

RemediationAI

Upgrade Open5GS to a patched version released after the vulnerability disclosure; vendors should check the official Open5GS repository for available updates beyond 2.7.7. Since the project was notified early but has not yet responded according to the description, monitor the official GitHub repository (https://github.com/open5gs/open5gs/) and the issue tracker (https://github.com/open5gs/open5gs/issues/4435) for patch releases. As an interim compensating control, implement rate-limiting on SBI service discovery requests at the network perimeter or load balancer to reduce denial-of-service impact, though this does not address the root cause. Additionally, restrict network access to the NSSF SBI interface to only authorized service instances and employ input validation/sanitization at the application layer for service name parameters passed to the vulnerable function. These controls trade off operational flexibility for availability protection but do not prevent exploitation if an authenticated service is compromised.