CVE-2026-78158 is an improper authorization vulnerability in Open5GS AMF's UEContextReleaseRequest handler. The handler fails to properly validate that incoming requests legitimately originate from authorized Network Functions, allowing an attacker to trigger UE context releases they should not have authority to invoke. The CVSS 6.3 score is misleading: in a 5G service-based architecture where NFs share state across trust boundaries, a single unauthorized context release can orphan state in the SMF and trigger cascading re-registration floods that degrade the entire AMF connection table. The blast radius is structural, not linear.
This is not a one-off code gap — it is a structural vulnerability class. The 3GPP specifications describe state transitions in meticulous detail but leave implicit which NF owns authorization at each boundary. Open5GS developers implementing thousands of pages under compatibility pressure inherit these implicit trust assumptions. The handler receives requests from other NFs across exposed service-based interfaces and must independently verify authorization claims that the calling NF may have assumed but never validated. No single development team can anticipate all trust boundary permutations in this architecture.
You should treat this as a class vulnerability, not an isolated fix. Audit UEContextReleaseCommand, UEContextModification, and similar state management handlers for the same pattern — if one handler missed authorization, others likely did. Implement explicit entity identity and sequence validation at every inter-NF handler boundary, even where the spec is silent on the requirement. Tag each handler with threat boundaries during development. The fix isn't just patching this handler — it is building explicit threat modeling into the development process at every 3GPP service-based interface.
Be aware of remediation lag: Open5GS ships to carriers who integrate, test, and deploy on their own 18-24 month timelines. A medium-severity CVE becomes an exposure-weighted 9+ when it persists in production networks long after the patch exists. If conformance testing validates interface behavior but not security posture, carriers have no signal that they are running systemic debt.