Mapping the rApp Attack Surface: A Threat Analysis of Third-Party Applications in O-RAN

The disaggregation of Radio Access Network (RAN) functions and the adoption of open interfaces, as defined by the O-RAN Alliance, represent a fundamental shift in how mobile networks are built and operated. Central to this vision is the Non-Real-Time RAN Intelligent Controller (Non-RT RIC), which hosts third-party applications known as rApps to deliver AI/ML-driven network optimization through standardized interfaces. While this open ecosystem unlocks significant flexibility and vendor diversity, it simultaneously expands the network threat surface in ways that existing security frameworks have not fully addressed. This article systematically analyzes the security risks introduced by third-party rApps on the Non-RT RIC, identifying four principal threat vectors: supply chain and onboarding vulnerabilities, policy manipulation via the A1 interface, data exfiltration through the Service Management and Orchestration (SMO) telemetry pipelines, and lateral movement across the rApp service mesh. Through illustrative attack scenarios, we demonstrate how these threats can result in network slice degradation, user equipment data exposure, and cascading compromise across RIC components. We further evaluate the adequacy of current O-RAN Alliance security specifications, particularly WG11, and identify critical standardization gaps. To address these risks, we propose a layered mitigation framework encompassing rApp certification, zero-trust API access controls, runtime behavioral monitoring, and container-level sandboxing. Our analysis highlights the urgent need for security-by-design principles to be embedded into the rApp ecosystem before large-scale O-RAN deployments mature, and calls on standardization bodies, network operators, and rApp vendors to treat openness and security as complementary rather than competing objectives.