CVE-2026-68923: MobSF CSRF Vulnerability

CVE-2026-68923 Overview

CVE-2026-68923 is a Cross-Site Request Forgery (CSRF) vulnerability in Mobile Security Framework (MobSF), an open-source mobile application security testing tool. Versions prior to 4.5.1 register django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting in mobsf/MobSF/settings.py and omit it from the active MIDDLEWARE tuple. As a result, authenticated web endpoints do not enforce CSRF token validation. A remote attacker can trick a logged-in victim into submitting cross-site POST requests to sensitive endpoints. The issue is tracked under [CWE-352] and fixed in MobSF 4.5.1.

Critical Impact
An attacker can force a logged-in MobSF user to delete scans, upload or download applications, change their password, or create and delete users with the victim's privileges.

Affected Products

Mobile Security Framework (MobSF) versions prior to 4.5.1
Deployments exposing the MobSF web interface to browsers with authenticated sessions
MobSF instances relying on the default Django settings shipped in mobsf/MobSF/settings.py

Discovery Timeline

2026-08-18 - CVE-2026-68923 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68923

Vulnerability Analysis

MobSF is built on Django and relies on Django's built-in CSRF protection through django.middleware.csrf.CsrfViewMiddleware. In vulnerable releases, this middleware is declared under the legacy MIDDLEWARE_CLASSES variable, which modern Django versions no longer read. The active MIDDLEWARE tuple, which Django actually loads, omits the CSRF middleware entirely. Because Django does not fall back to the deprecated setting, no CSRF token validation runs against incoming POST requests. Authenticated endpoints therefore accept forged cross-origin submissions as long as the victim's session cookie is sent by the browser.

Impacted routes include /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. These endpoints cover scan lifecycle management, artifact handling, and user administration. An attacker exploiting CVE-2026-68923 gains write access to all of these actions at the victim's privilege level, including administrative account takeover through /change_password/ or /create_user/.

Root Cause

The defect is a configuration error rather than a code-level flaw. Django deprecated MIDDLEWARE_CLASSES in favor of MIDDLEWARE, and the CSRF middleware was never migrated to the current setting name. This left the framework's default CSRF protection disabled without any visible error at runtime.

Attack Vector

Exploitation requires an authenticated MobSF user to visit an attacker-controlled page. The malicious page issues a cross-origin POST (for example, via an auto-submitting HTML form) to a MobSF endpoint such as /change_password/. The victim's browser attaches the MobSF session cookie, and the server processes the request because no CSRF token is validated. User interaction is required, but no attacker credentials or elevated privileges are needed.

python

# Patch context: MobSF Security Updates July 5 2026 (PR #2627)
# Security-related helpers were centralized into mobsf/MobSF/security
# as part of the same hotfix release that ships the CSRF fix in v4.5.1.

from mobsf.DynamicAnalyzer.views.common.shared import (
    invalid_params,
    send_response,
)
from mobsf.MobSF.security import is_attack_pattern
from mobsf.DynamicAnalyzer.views.android.environment import (
    Environment,
)
from mobsf.MobSF.security import cmd_injection_check
from mobsf.MobSF.utils import (
    docker_translate_localhost,
    get_adb,
    get_device,
)
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf

The CSRF fix itself moves django.middleware.csrf.CsrfViewMiddleware into the active MIDDLEWARE tuple in mobsf/MobSF/settings.py, restoring Django's default token validation on state-changing endpoints.

Detection Methods for CVE-2026-68923

Indicators of Compromise

POST requests to /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, or /delete_user/ with Referer or Origin headers pointing to unrelated third-party domains.
Unexpected account creations, password changes, or scan deletions in MobSF audit logs that do not correlate with legitimate administrator activity.
MobSF web sessions issuing sensitive POST requests immediately after the user visited an external link or opened an untrusted email.

Detection Strategies

Inspect web server or reverse-proxy access logs for POST requests to the affected endpoints whose Referer header is missing or off-origin.
Compare MobSF user administration events (/create_user/, /delete_user/, /change_password/) against ticketing or change-management records to identify unauthorized modifications.
Alert on MobSF responses that succeed on state-changing endpoints without a preceding GET that would normally deliver a CSRF token.

Monitoring Recommendations

Forward MobSF application and reverse-proxy logs to a centralized log platform and retain them for post-incident review.
Monitor the MobSF host process for the version string and alert if an instance below 4.5.1 remains in production.
Track outbound browser telemetry from analyst workstations to flag visits to untrusted domains during active MobSF sessions.

How to Mitigate CVE-2026-68923

Immediate Actions Required

Upgrade MobSF to version 4.5.1 or later, which restores CsrfViewMiddleware in the active MIDDLEWARE tuple.
Force logout of all active MobSF sessions and rotate credentials for administrative accounts after upgrading.
Restrict MobSF web access to trusted networks or a VPN so browsers on untrusted networks cannot reach authenticated endpoints.

Patch Information

The vendor released the fix in MobSF v4.5.1. The code change is available in the upstream commit and merged via pull request #2627. Full details are published in GitHub Security Advisory GHSA-3p54-567p-2wpr.

Workarounds

If immediate upgrade is not possible, manually add django.middleware.csrf.CsrfViewMiddleware to the active MIDDLEWARE tuple in mobsf/MobSF/settings.py and restart the service.
Place MobSF behind a reverse proxy that enforces strict Referer and Origin header checks for POST requests to authenticated endpoints.
Instruct analysts to run MobSF in an isolated browser profile and log out immediately after use to reduce the window for CSRF exploitation.

bash

# Verify the running MobSF version and confirm remediation
pip show mobsf | grep -i version

# Grep the settings file to confirm CsrfViewMiddleware is in the active MIDDLEWARE tuple
grep -n "CsrfViewMiddleware" mobsf/MobSF/settings.py

# Expected: entry present inside MIDDLEWARE = [ ... ], not only MIDDLEWARE_CLASSES