CVE-2026-8730 is a medium severity denial of service vulnerability affecting Open5GS versions 2.7.0 through 2.7.6. The vulnerability resides in the NRF component within the function ogs_sbi_nf_instance_set_id in /lib/sbi/context.c. An attacker with low privileges can remotely manipulate the nfInstanceId argument, causing a denial of service condition. The vulnerability has been publicly disclosed with exploit code available, but the Open5GS project has not yet issued a fix or official response. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on availability.

Successful exploitation of this vulnerability can cause denial of service in the Open5GS NRF component, potentially disrupting network function registry services. The impact is limited to service availability and does not indicate confidentiality or integrity compromise. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the Open5GS project. Users should monitor the vendor's advisories for updates. Until a fix is released, consider restricting access to the affected NRF service to trusted networks to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.