CVE-2026-68927— MobSF: SSRF port restriction bypass in assetlinks_check
Quick assessment
Affected
MobSF Mobile-Security-Framework-MobSF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MobSF 是一款移动应用安全测试工具。在版本 4.5.1 之前， 文件中的 函数仅对 Android 清单文件中的 值通过 进行验证，随后会将从外部单独提供的 附加到由 获取的 URL 中。这允许经过身份验证的用户上传精心构造的 APK 文件，使其对攻击者指定的非标准端口发起针对 路径的请求。结合攻击者控制的域名以及在 DNS 重绑定攻击中验证与 实际连接之间发生的域名切换，请求可能到达内部服务（尽管重定向已被禁用，且路径固定）。该问题已在 4.5.1 版本中得到修复。
Possible ATT&CK Techniques 2 AI
T1071 · Application Layer Protocol T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.5.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-68927
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MobSF: SSRF port restriction bypass in assetlinks_check
Source: CVE Program / CVE List V5
Vulnerability Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.5.1 | - |
|
II. Public POCs for CVE-2026-68927
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68927
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-68927 (1)
Vendor Advisories for CVE-2026-68927 (1)
Vendor Pages for CVE-2026-68927 (1)
-
🔗 Release v4.5.1 · MobSF/Mobile-Security-Framework-MobSF · GitHub x_refsource_MISC
Same Patch Batch · MobSF · 2026-08-18 · 4 CVEs total
| CVE-2026-68923 | 6.5 MEDIUM | MobSF: CSRF checks not enforced after Django migration |
| CVE-2026-68922 | 5.5 MEDIUM | MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads |
| CVE-2026-68924 | 4.9 MEDIUM | MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction |
IV. Related Vulnerabilities
Same product: Mobile-Security-Framework-MobSF
-
CVE-2026-68923
MobSF: CSRF checks not enforced after Django migration -
CVE-2026-68922
MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads -
CVE-2026-68924
MobSF: Zip Bomb Denial of Service via Per-File Size Limit By -
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils -
CVE-2026-24490
MobSF has Stored XSS via Manifest Analysis - Dialer Code Hos
Same vendor: MobSF
-
CVE-2026-68923
MobSF: CSRF checks not enforced after Django migration -
CVE-2026-68922
MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads -
CVE-2026-68924
MobSF: Zip Bomb Denial of Service via Per-File Size Limit By -
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils -
CVE-2026-24490
MobSF has Stored XSS via Manifest Analysis - Dialer Code Hos
Same weakness: CWE-918
-
CVE-2026-78061
vas3k TaxHacker Email Sync imap-client.ts buildImapConfig se -
CVE-2026-63311
NLTK before 3.10.0 SSRF via DNS Resolution Failure -
CVE-2026-78003
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side -
CVE-2026-53509
@aborruso/ckan-mcp-server: SSRF via base_url allows access t -
CVE-2026-50288
@asymmetric-effort/specifyjs: URL parse failure silently all
V. Comments for CVE-2026-68927
No comments yet