← Vulnerability feed

Vulnerability record · CVE-2026-37233 · published 1 June 2026

CVE-2026-37233: Mosaic5g flexric vulnerability

MMosaic5g · Flexric

FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.

7.5 CVSS 3.1 High EPSS 0.57% · top 55.1% CWE-617 · CWE-617
7.5CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
22 Jul 2026Last modified by NVD

Description

FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37233.md ExploitMitigationThird Party Advisory
https://gitlab.eurecom.fr/mosaic5g/flexric Product

Track CVE-2026-37233 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2026-37234Mosaic5g flexric uncontrolled resource consumption vulnerabilityFlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first regist…EPSS 0.53%7.5CVE-2026-37226Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, w…EPSS 0.64%7.5CVE-2026-37228Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and …EPSS 0.64%7.5CVE-2026-37229Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can sen…EPSS 0.62%7.5CVE-2026-37230Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup retu…EPSS 0.64%7.5CVE-2026-37231Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the …EPSS 0.61%7.5CVE-2026-37235Mosaic5g flexric improper access control vulnerabilityFlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_…EPSS 0.57%

Source: NIST National Vulnerability Database (record CVE-2026-37233), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.