CVE-2026-68927: CVE-2026-68927: Server-Side Request Forgery Port Restriction Bypass in Mobile Security Framework (MobSF)

#security #cve #cybersecurity

CVE-2026-68927: Server-Side Request Forgery Port Restriction Bypass in Mobile Security Framework (MobSF)

Vulnerability ID: CVE-2026-68927
CVSS Score: 3.0
Published: 2026-08-18

A Server-Side Request Forgery (SSRF) vulnerability exists in Mobile Security Framework (MobSF) prior to version 4.5.1. The flaw occurs in the Android App Link validation process, where a split-validation vulnerability allows an authenticated attacker to perform port restriction bypasses and potential DNS rebinding attacks against internal infrastructure.

TL;DR

MobSF prior to 4.5.1 validates the hostname of an Android App Link but appends the port afterward without validation, enabling SSRF and port scanning via crafted APK uploads.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-918
Attack Vector: Network (AV:N)
CVSS Score: 3.0 (Low)
EPSS Score: N/A
Impact: Low Confidentiality
Exploit Status: Proof-of-Concept / Conceptual
KEV Status: Not Listed

Affected Systems

Mobile Security Framework (MobSF)
Mobile-Security-Framework-MobSF: < 4.5.1 (Fixed in: 4.5.1)

Code Analysis

Commit: 62563ca

Fix SSRF port bypass in assetlinks check

Mitigation Strategies

Restrict outbound HTTP traffic from the MobSF server to internal network segments using network firewalls.
Implement egress filtering to allow connections only to known public IP addresses.
Ensure DNS resolution within the MobSF environment is hardened against DNS rebinding attacks.

Remediation Steps:

Audit the currently deployed MobSF version.
Update the MobSF deployment to version 4.5.1 or higher.
If running via Docker, pull the latest image version (>= 4.5.1) and restart the container.

References

Read the full report for CVE-2026-68927 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community