Open5GS Authentication Bypass in NGAP Message Handler

A vulnerability was identified in Open5GS up to 2.7.6. This impacts an unknown function of the file src/amf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is a188e36b1741ffc2252133f59b1bda4f14d3cb5c. It is suggested to install a patch to address this issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-10157 exposes a critical authentication flaw in Open5GS versions up to 2.7.6, specifically within the NGAP PathSwitchRequest Message Handler component. This vulnerability allows attackers to bypass authentication mechanisms in the core telecom infrastructure layer, directly impacting 5G network operators and their subscribers. The remote exploitability combined with publicly available exploit code makes this a high-risk threat to mobile network operators who rely on Open5GS for network access and mobility management functions.

Casky's 261 mapped security skills leverage Claude's extended reasoning to detect the attack patterns spanning MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious NGAP PathSwitchRequest messages that bypass standard authentication checks, anomalous device handoff procedures lacking proper credential validation, and unauthorized access attempts to core network functions that should require explicit authentication. The platform's skill set enables detection of improper authentication workflows (CWE-287) by analyzing network signaling patterns, authentication state transitions, and device mobility events that deviate from expected 5GS security procedures, allowing security teams to pinpoint exploitation attempts before credentials are compromised or privilege escalation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10157.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-10157

Casky has 261 skills that investigate the attack patterns behind CVE-2026-10157. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn