CVE-2026-8291
Last modified
CVE-2026-8291 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the file lib/sbi/nnrf-handler.c of the component NRF. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Open5gs | Open5gs | <= 2.7.7 |
References
- https://github.com/open5gs/open5gs/issues/4456Exploit, Issue Tracking
- https://github.com/open5gs/open5gs/pull/4534Exploit, Issue Tracking, Patch
- https://vuldb.com/submit/808508Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/362588Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/362588/ctiPermissions Required, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-8291?
How severe is CVE-2026-8291?
How do I fix CVE-2026-8291?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8285Improper restriction of excessive authentication attempts vu…4.3
- CVE-2026-8286A vulnerability exists where a new transfer that uses STARTT…8.1
- CVE-2026-8287Allocation of resources without limits or throttling vulnera…4.3
- CVE-2026-8288A vulnerability was determined in Open5GS up to 2.7.7. This …6.5
- CVE-2026-8289A vulnerability was identified in Open5GS up to 2.7.7. This …6.5
- CVE-2026-8290A security flaw has been discovered in Open5GS up to 2.7.7. …6.5
- CVE-2026-8292A security vulnerability has been detected in Open5GS up to …6.5
- CVE-2026-8293The Really Simple Security WordPress plugin before 9.5.10.1…7.5
- CVE-2026-8295An integer overflow vulnerability in the simdjson document-b…6.9
- CVE-2026-8296In affected versions of Octopus Server with certain access l…5.6
- CVE-2026-8297Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-8305A vulnerability was detected in OpenClaw up to 2026.1.24. Th…9.8
Are you affected by CVE-2026-8291?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST