CVE-2026-68927: MobSF SSRF Vulnerability

CVE-2026-68927 Overview

CVE-2026-68927 is a Server-Side Request Forgery (SSRF) vulnerability in Mobile Security Framework (MobSF), an open-source mobile application security testing tool. The flaw exists in the get_browsable_activities function in mobsf/StaticAnalyzer/views/android/manifest_analysis.py in versions prior to 4.5.1. The function validates only the android:host value from an Android manifest before appending a separately supplied android:port and passing the URL to _check_url. An authenticated user can upload a crafted APK that triggers requests to attacker-selected nonstandard ports at /.well-known/assetlinks.json. The vulnerability is tracked as CWE-918.

Critical Impact
Authenticated attackers can leverage DNS rebinding between validation and connection to reach internal services from the MobSF host, despite redirects being disabled and the URL path being fixed.

Affected Products

MobSF (Mobile Security Framework) versions prior to 4.5.1
Static Analyzer component (manifest_analysis.py)
Deployments accepting authenticated APK uploads

Discovery Timeline

2026-08-18 - CVE-2026-68927 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-68927

Vulnerability Analysis

The vulnerability resides in MobSF's static analyzer routine that inspects Android manifest entries for browsable activities. When an APK declares an intent-filter with a data element, MobSF extracts the android:host and passes it to valid_host for validation. The port supplied via android:port bypasses this validation entirely. The resulting URL is then submitted to _check_url, which performs an HTTP GET against /.well-known/assetlinks.json.

Because validation happens before the network request, a Time-of-Check to Time-of-Use (TOCTOU) window exists between hostname resolution during validation and the subsequent requests.get connection. An attacker controlling authoritative DNS for the manifest hostname can perform DNS rebinding to resolve first to a public address and then to an internal RFC1918 address. Although MobSF disables HTTP redirects and pins the request path, an attacker can still probe internal services and reach nonstandard ports on the MobSF host network.

Root Cause

The root cause is incomplete input validation on manifest-derived URL components. valid_host inspects only the hostname string, ignoring the caller-supplied port that is concatenated into the final URL. Compounding this, hostname validation is not tied atomically to the outbound request, permitting DNS rebinding.

Attack Vector

Exploitation requires an authenticated MobSF user with permission to upload APKs. The attacker crafts a manifest that declares a browsable activity with a controlled hostname and a target internal port. During analysis, MobSF issues an HTTP GET request from its own network context to the attacker-selected host:port combination, enabling reconnaissance of internal services otherwise unreachable from outside the perimeter.

The patch consolidates security helper functions into a dedicated mobsf.MobSF.security module and reworks input validation across upload and device handling paths:

python

 from mobsf.DynamicAnalyzer.views.common.shared import (
     invalid_params,
-    is_attack_pattern,
     send_response,
 )
+from mobsf.MobSF.security import is_attack_pattern
 from mobsf.DynamicAnalyzer.views.android.environment import (
     Environment,
 )
+from mobsf.MobSF.security import cmd_injection_check
 from mobsf.MobSF.utils import (
-    cmd_injection_check,
     docker_translate_localhost,
     get_adb,
     get_device,

Source: GitHub Commit 62563ca

Detection Methods for CVE-2026-68927

Indicators of Compromise

Outbound HTTP GET requests from the MobSF host to internal IP ranges targeting /.well-known/assetlinks.json
Uploaded APKs containing manifest intent-filter entries with nonstandard android:port values pointing at internal service ports (for example, 6379, 8500, 9200, 169.254.169.254 for cloud metadata)
DNS queries from the MobSF host resolving the same hostname to alternating public and private addresses within short intervals

Detection Strategies

Inspect MobSF web server access logs for repeated static analysis jobs that reference unusual hostnames or ports in scanned manifests
Correlate MobSF process network telemetry with target IP addresses inside the internal network or link-local metadata ranges
Alert on DNS responses to MobSF servers containing TTL values below 60 seconds combined with mixed public/private answers

Monitoring Recommendations

Deploy egress filtering to restrict the MobSF host from initiating connections to internal management networks and cloud metadata endpoints
Log all APK upload events with the associated authenticated user identity and correlate against unusual outbound traffic bursts
Baseline expected outbound destinations for MobSF and alert on deviations, particularly requests to nonstandard ports

How to Mitigate CVE-2026-68927

Immediate Actions Required

Upgrade MobSF to version 4.5.1 or later, which contains the fix from pull request #2627
Restrict MobSF instances to trusted internal users and enforce strong authentication for the web interface
Place MobSF in a network segment that cannot reach internal management services or cloud metadata APIs

Patch Information

The issue is resolved in MobSF release v4.5.1. Details are published in GitHub Security Advisory GHSA-95px-34x5-p37h. The fix validates the complete URL including the port and centralizes security helper functions in a new mobsf.MobSF.security module.

Workarounds

Block outbound traffic from MobSF hosts to RFC1918 ranges and link-local addresses (169.254.0.0/16) using host or network firewall rules
Pin DNS resolution for scan targets to authoritative resolvers that do not honor low-TTL rebinding responses, or run MobSF behind a resolver that filters private-range answers
Disable or restrict APK upload capability for untrusted accounts until the upgrade is applied

bash

# Upgrade MobSF via pip
pip install --upgrade mobsf==4.5.1

# Verify installed version
mobsf --version

# Example iptables egress rule blocking MobSF access to RFC1918 destinations
iptables -A OUTPUT -m owner --uid-owner mobsf -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mobsf -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mobsf -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mobsf -d 169.254.0.0/16 -j REJECT