CVE-2026-8268 describes a denial-of-service (DoS) vulnerability discovered in Open5GS versions 2.7.0 through 2.7.7. The vulnerability resides within the SMF component's OpenAPIlistcreate function, allowing remote attackers to induce a service disruption. While the issue has been reported to the Open5GS project, a response has not yet been received, leaving systems potentially exposed.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-8268 allows an attacker to remotely trigger a denial-of-service condition within the Open5GS system. This means legitimate users and services relying on Open5GS will be unable to access or utilize the affected functionality. The impact can range from temporary service outages to complete system unavailability, potentially disrupting critical network operations. The ability to launch the attack remotely significantly broadens the potential attack surface, making it easier for malicious actors to target vulnerable deployments. The lack of a response from the project increases the risk of exploitation.
Exploitation Context
CVE-2026-8268 has been publicly disclosed, increasing the likelihood of exploitation. The vulnerability's DoS nature makes it a relatively simple attack to execute, potentially lowering the barrier to entry for malicious actors. The EPSS score is likely to be assessed as Medium, reflecting the public disclosure and ease of exploitation. Active campaigns targeting this vulnerability are currently unknown, but the public disclosure warrants heightened vigilance.
Threat Intelligence
Exploit Status
EPSS
0.04% (12% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- Low — partial or intermittent denial of service. Attacker can degrade performance.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- EPSS updated
Mitigation and Workarounds
Given the lack of a patch from the Open5GS project, immediate mitigation strategies are crucial. Consider implementing rate limiting on incoming requests to the SMF component to reduce the impact of potential DoS attacks. Network firewalls can be configured to block suspicious traffic patterns. If possible, isolate the Open5GS instance within a segmented network to limit the blast radius of a successful attack. Continuously monitor system logs for unusual activity that might indicate an ongoing attack. While a direct fix is unavailable, these workarounds can help reduce the risk until a patch is released.
How to fix
Se recomienda actualizar Open5GS a una versión posterior a la 2.7.7 para mitigar la vulnerabilidad de denegación de servicio. Verificar la documentación oficial de Open5GS para obtener instrucciones de actualización específicas. Dado que el proyecto no ha respondido, se recomienda monitorear activamente las actualizaciones de seguridad.
Frequently asked questions
What is CVE-2026-8268 — DoS in Open5GS 2.7.0-2.7.7?
CVE-2026-8268 is a denial-of-service vulnerability affecting Open5GS versions 2.7.0 through 2.7.7. It allows remote attackers to disrupt service by manipulating the OpenAPIlistcreate function within the SMF component.
Am I affected by CVE-2026-8268 in Open5GS 2.7.0-2.7.7?
If you are running Open5GS version 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, or 2.7.7, you are potentially affected by this vulnerability.
How do I fix CVE-2026-8268 in Open5GS 2.7.0-2.7.7?
A patch is not currently available. Mitigate by implementing rate limiting, network firewall rules, and isolating the Open5GS instance.
Is CVE-2026-8268 being actively exploited?
While active campaigns are currently unknown, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Where can I find the official Open5GS advisory for CVE-2026-8268?
As of the publication date, no official advisory has been released by the Open5GS project. Monitor their website and mailing lists for updates.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...