Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-11 | 2 | Disclosure1Patch1 |
| 2026-05-12 | 1 | Patch1 |
| 2026-05-13 | 2 | General2 |
「プッシュ通知に関する通信における証明書検証不備（CVE-2026-41872）」／ くら寿司アプリに脆弱性 通信内容が盗聴・改ざんされる恐れ https://weekly.ascii.jp/elem/000/004/400/4400863/ @weeklyasciiより
Post summary
The article announces the discovery of a certificate verification flaw affecting push notifications in the KuraKura sushi app, highlighting potential interception or tampering of communications.
https://security.splash-eng.com/higashiyama-qilin-ransomware-leak-2026/ https://security.splash-eng.com/kura-sushi-app-cve-2026-41872/ https://security.splash-eng.com/canon-multifunction-cve-2026-1789/ https://security.splash-eng.com/shinnihon-kentei-ransomware-2026/
Post summary
The linked articles appear to discuss newly disclosed CVEs and ransomware incidents, but they do not provide evidence of a PoC, exploit code, active exploitation, or a patch, though technical details about the vulnerabilities are likely present.
くら寿司 公式アプリに危険度の高い脆弱性 CVE-2026-41872-悪意ある無線LANでプッシュ通知の盗聴・改ざんが可能 https://rocket-boys.co.jp/security-measures-lab/kura-sushi-app-high-severity-flaw-cve-2026-41872/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces a high‑severity vulnerability (CVE‑2026‑41872) in the Kura Sushi app that permits malicious wireless LANs to eavesdrop and alter push notifications, but it provides no PoC, exploitation details, or patch information.
🚨 CVE-2026-41872: Kura Sushi Official App vulnerable to MITM. Certificate validation failure enables push notification interception. Entity detects EPG Inc deployment. Update immediately. https://0x2ed3bb60.xyz/threat/06018232187776cf
Post summary
The tweet announces CVE‑2026‑41872 against the Kura Sushi Official App, describing a certificate validation flaw that enables MITM push‑notification interception, and urges users to update immediately.
『なお、開発者によると、本件の影響を受けるバージョンを使用している場合、起動時に即時アップデートを強制されるとのことです』 CVE-2026-41872 JVN#38632731: スマートフォンアプリ「くら寿司 公式アプリ」における証明書検証不備の脆弱性 https://jvn.jp/jp/JVN38632731/index.html
Post summary
The Japanese vendor will enforce an immediate update on affected versions of the Kurazushi app to address a certificate verification flaw (CVE‑2026‑41872).