CVE-2026-10157: Open5GS NGAP Authentication Bypass Vulnerability – 5G Core Network Risk

Technical summary

The vulnerability resides in src/amf/ngap-handler.c within the NGAP PathSwitchRequest Message Handler component of Open5GS. It stems from improper authentication logic (CWE-287: Improper Authentication) when processing specific NGAP signaling messages during handover or path-switch scenarios. The flaw permits an attacker to craft a malicious PathSwitchRequest that bypasses authentication verification, allowing unauthorized access to Access and Mobility Management Function (AMF) resources. The attack is network-accessible, requires no credentials or user interaction, and can be executed by an unauthenticated remote actor. A patch is available (commit a188e36b1741ffc2252133f59b1bda4f14d3cb5c).

Business impact

Organizations running Open5GS in production 5G deployments face significant operational and security risk. An attacker exploiting this flaw could intercept, reroute, or hijack 5G traffic, execute man-in-the-middle attacks, or gain unauthorized access to sensitive network functions. For telecom operators or private 5G network administrators, this could lead to service disruption, data theft, regulatory violations, and loss of customer trust. The availability of public exploit code substantially increases the likelihood of opportunistic attacks.

Affected systems

Open5GS versions up to and including 2.7.6 are vulnerable. This includes both community deployments and any production 5G testbeds or private networks built on this codebase. Organizations using newer versions should verify their exact version and patch status. No official vendor advisory with comprehensive product enumeration was provided; operators should cross-reference their deployment inventory against the affected version range.

Exploitability

This vulnerability is highly exploitable in practice. The attack requires no authentication, no user interaction, and is network-accessible from an unauthenticated remote position. The CVSS v3.1 score of 7.3 (HIGH) reflects low attack complexity and broad attack surface. Publicly available exploit code is documented, and no known mitigations or workarounds exist short of patching. Threat actors targeting 5G infrastructure or telecommunications operators are likely already aware and actively testing this flaw.

Remediation

Immediate patching is strongly recommended. Organizations must update Open5GS to a version newer than 2.7.6 that includes the security fix (commit a188e36b1741ffc2252133f59b1bda4f14d3cb5c). For operators unable to patch immediately, network segmentation—isolating the AMF from untrusted networks and enforcing strict firewall rules on NGAP traffic—can reduce but not eliminate risk. Monitoring for anomalous PathSwitchRequest patterns and implementing intrusion detection signatures may provide detection-layer defense while patches are prepared.

Patch guidance

Verify and deploy the patched version of Open5GS that includes commit a188e36b1741ffc2252133f59b1bda4f14d3cb5c. Consult the Open5GS project repository and release notes to identify the corresponding tagged release version. Testing patches in a non-production environment before deployment is essential to confirm compatibility with your specific 5G network configuration. Plan patching during a maintenance window to minimize service disruption, particularly if your network handles active subscribers or critical traffic.

Detection guidance

Monitor NGAP traffic for unusual PathSwitchRequest messages originating from unauthenticated sources or containing malformed authentication fields. Implement deep packet inspection (DPI) rules to detect anomalous NGAP signaling patterns. Log and alert on authentication failures within the AMF component, especially when originating from unexpected network addresses. Correlate NGAP events with Access Point Name (APN) or handover anomalies. Network-based intrusion detection systems (IDS) tuned for 5G protocol violations may also flag exploit attempts.

Why prioritize this

This vulnerability warrants immediate attention due to its combination of high exploitability (unauthenticated, network-accessible, public exploit code available), high severity (authentication bypass in core network), and broad impact on 5G infrastructure. The CVSS score of 7.3 and the absence of the vulnerability from the CISA Known Exploited Vulnerabilities (KEV) catalog does not diminish urgency; the public availability of exploit code makes widespread compromise probable. Organizations running Open5GS in any production or critical role should treat this as a priority-one patch.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) is derived from a network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) within the vulnerable component (S:U). This score appropriately reflects a remotely exploitable authentication bypass with no prerequisites. In context, the availability of public exploit code elevates real-world risk beyond the base CVSS score, and operators should apply organizational and environmental scoring adjustments if performing a full CVSS assessment.

Frequently asked questions