CVE-2026-40245

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vulnerability in the UDR (Unified Data Repository) service. The handler for GET /nudr-dr/v2/application-data/influenceData/subs-to-notify sends an HTTP 400 error response when required query parameters are missing but does not return afterward. Execution continues into the processor function, which queries the data repository and appends the full list of Traffic Influence Subscriptions, including SUPI/IMSI values, to the response body. An unauthenticated attacker with network access to the 5G Service Based Interface can retrieve stored subscriber identifiers with a single parameterless HTTP GET request. The SUPI is the most sensitive subscriber identifier in 5G networks, and its exposure undermines the privacy guarantees of the 3GPP SUCI concealment mechanism at the core network level. A similar bypass exists when sending a malformed snssai parameter due to the same missing return pattern.

• CWE-200
• CWE-202
• CWE-209

• https://github.com/free5gc/free5gc/security/advisories/GHSA-wrwh-rpq4-87hfExploit, Third Party Advisory
• https://github.com/free5gc/free5gc/security/advisories/GHSA-wrwh-rpq4-87hfExploit, Third Party Advisory

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40229Helpy contains a stored cross-site scripting vulnerability i…5.4
• CVE-2026-40230Helpy contains a stored cross-site scripting vulnerability i…5.4
• CVE-2026-4024The Royal Addons for Elementor plugin for WordPress is vulne…5.3
• CVE-2026-40242Arcane is an interface for managing Docker containers, image…6.5
• CVE-2026-40243Incus is a system container and virtual machine manager. In …4.8
• CVE-2026-40244OpenEXR provides the specification and reference implementat…7.1
• CVE-2026-40246free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-40247free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-40248free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-40249free5GC is an open-source implementation of the 5G core netw…5.3
• CVE-2026-4025The PrivateContent Free plugin for WordPress is vulnerable t…6.4
• CVE-2026-40250OpenEXR provides the specification and reference implementat…7.1