MEDIUMCVE-2026-41281CVSS 4.8

CVE-2026-41281: Cleartext Transmission in あんしんフィルター for au

Platform

android

Component

anshin-filter-for-au

Fixed in

4.9_b0003

CVE-2026-41281 describes a Cleartext Transmission of Sensitive Information vulnerability within the Android application "あんしんフィルター for au," developed by KDDI CORPORATION. This flaw enables a man-in-the-middle (MITM) attacker to potentially intercept and manipulate communications transmitted without encryption. The vulnerability affects versions prior to 4.9b0003, and a fix is available in version 4.9b0003.

Android / Gradle

Detect this CVE in your project

Upload your build.gradle file and we'll tell you instantly if you're affected.

Impact and Attack Scenarios

The primary impact of CVE-2026-41281 is the potential for sensitive data to be exposed or tampered with. A successful MITM attack could allow an attacker to intercept usernames, passwords, personal information, or other confidential data transmitted by the application. This could lead to identity theft, financial loss, or unauthorized access to user accounts. The attacker could also modify the data in transit, potentially injecting malicious content or altering the application's behavior. Given the nature of the vulnerability, the blast radius extends to any user of the application who transmits sensitive information over an insecure network.

Exploitation Context

CVE-2026-41281 was published on May 13, 2026. Severity is currently assessed as Medium. Public proof-of-concept (POC) code is not currently available, but the vulnerability's nature makes it susceptible to exploitation in environments with compromised network infrastructure. The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of active exploitation at this time. Refer to KDDI CORPORATION's advisory for further details.

Threat Intelligence

Exploit Status

Proof of ConceptUnknown
CISA KEVNO
Internet ExposureHigh
Reports1 threat report

CVSS Vector

THREAT INTELLIGENCE· CVSS 3.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N4.8MEDIUMAttack VectorNetworkHow the attacker reaches the targetAttack ComplexityHighConditions required to exploitPrivileges RequiredNoneAuthentication level needed to attackUser InteractionNoneWhether a victim must take actionScopeUnchangedImpact beyond the vulnerable componentConfidentialityLowRisk of sensitive data exposureIntegrityLowRisk of unauthorized data modificationAvailabilityNoneRisk of service disruptionnextguardhq.com · CVSS v3.1 Base Score
What do these metrics mean?
Attack Vector
Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
Attack Complexity
High — requires a race condition, non-default configuration, or specific circumstances. Harder to exploit reliably.
Privileges Required
None — unauthenticated. No login or credentials needed to exploit.
User Interaction
None — attack is automatic and silent. Victim does nothing: no click, no file open.
Scope
Unchanged — impact is limited to the vulnerable component itself.
Confidentiality
Low — partial or indirect data access. Attacker gains limited information.
Integrity
Low — attacker can modify some data with limited scope or impact.
Availability
None — no availability impact. Service remains fully operational.

Affected Software

Componentanshin-filter-for-au
VendorKDDI CORPORATION
Minimum versionprior to 4.9_b0003
Maximum versionprior to 4.9_b0003
Fixed in4.9_b0003

Weakness Classification (CWE)

Timeline

  1. Reserved
  2. Published

Mitigation and Workarounds

The primary mitigation for CVE-2026-41281 is to upgrade the "あんしんフィルター for au" application to version 4.9_b0003 or later. If upgrading is not immediately feasible, consider implementing network-level protections such as VPNs or secure proxies to encrypt communications. While not a direct fix, these measures can reduce the risk of MITM attacks. Regularly monitor network traffic for suspicious activity and implement intrusion detection systems (IDS) to identify potential exploitation attempts. After upgrading, verify the fix by attempting to intercept network traffic between the application and the server to confirm that data is now transmitted securely.

How to fix

Actualice la aplicación あんしんフィルター for au a la versión 4.9_b0003 o posterior para mitigar la vulnerabilidad de transmisión de información confidencial en texto plano. Esto evitará que atacantes intercepten y modifiquen las comunicaciones.

Frequently asked questions

What is CVE-2026-41281 — Cleartext Transmission in あんしんフィルター for au?

CVE-2026-41281 is a Medium severity vulnerability in the "あんしんフィルター for au" app allowing MITM attacks to intercept unencrypted data. It affects versions before 4.9_b0003, potentially exposing sensitive information.

Am I affected by CVE-2026-41281 in あんしんフィルター for au?

You are affected if you are using "あんしんフィルター for au" version 4.9_b0003 or earlier. Check your app version and upgrade immediately to mitigate the risk.

How do I fix CVE-2026-41281 in あんしんフィルター for au?

Upgrade to version 4.9_b0003 or later. If immediate upgrade isn't possible, use VPNs or secure proxies to encrypt network traffic.

Is CVE-2026-41281 being actively exploited?

While no active exploitation is currently confirmed, the vulnerability's nature makes it a potential target. Monitor network traffic and implement detection measures.

Where can I find the official あんしんフィルター for au advisory for CVE-2026-41281?

Refer to KDDI CORPORATION's official security advisory for "あんしんフィルター for au" regarding CVE-2026-41281. Check the KDDI website or app store for updates.

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

Android / Gradle

Detect this CVE in your project

Upload your build.gradle file and we'll tell you instantly if you're affected.

livefree scan

Scan your Android / Gradle project now — no account

Upload your build.gradle and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.

Manual scanSlack/email alertsContinuous monitoringWhite-label reports

Drag & drop your dependency file

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...