CVE-2026-68927: MobSF SSRF port restriction bypass in assetlinks_check

CVE-2026-68927 · Severity: low · CVSS 3.1 · Published 2026-08-18

MobSF is a mobile security analysis framework used to scan and analyze Android applications for security vulnerabilities. An authenticated attacker can upload a crafted APK that bypasses MobSF's port restrictions, causing the server to make outbound requests to attacker-controlled ports. When combined with DNS rebinding techniques, this can enable attacks against internal services that normally run on restricted ports (like SSH on port 22), potentially exposing internal infrastructure to unauthorized access.

Technologies: mobsf (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-68927 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68927 being exploited in the wild.
How severe is CVE-2026-68927?
Low severity, with a CVSS score of 3.1, published 18 August 2026.
Which products and versions are affected?
MobSF Project Mobile Security Framework < 4.5.1; mobsf (PyPI) < 4.5.1, ECOSYSTEM:introduced=0,fixed=4.5.1.
Is there a fix for CVE-2026-68927?
Yes. mobsf (PyPI): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68927 attacked?
It is attacked over the network.
Am I affected by CVE-2026-68927?
Check whether you run MobSF Project Mobile Security Framework or mobsf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mobsf (PyPI): upgrade to 4.5.1 or later
    pip install "mobsf>=4.5.1"

Technical details

The vulnerability is a server-side request forgery (SSRF) bypass caused by separation of validation logic from URL assembly. The valid_host() function checks only the hostname component extracted from the Android manifest's android:host attribute, rejecting ports outside 80 and 443. However, the android:port attribute is extracted separately and concatenated into the final URL after the validation step, bypassing the port restrictions. The _check_url() function then performs only path/query/param validation before issuing the HTTP request via requests.get(). An authenticated attacker can craft an APK with a benign-looking hostname paired with a restricted port (e.g., port 22, 3389, 8080) in the manifest. Combined with DNS rebinding (where validation DNS resolution returns a public IP but the actual HTTP request resolves to an internal address), this enables SSRF to internal services. The fixed URL path (/.well-known/assetlinks.json) and disabled redirects (allow_redirects=False) limit the scope somewhat. MobSF versions before 4.5.1 are affected; version 4.5.1 and later contain patches.

Affected products

  • MobSF Mobile Security Framework MobSF < 4.5.1

Identifiers

  • CVE-2026-68927
  • GHSA-95px-34x5-p37h
  • PYSEC-2026-3690

Timeline

  • 2026-07-05: disclosed
  • 2026-08-18: advisory
  • 2026-08-18: patched: MobSF v4.5.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.