CVE-2026-41872: Kura Sushi App Certificate Vulnerability

CVE-2026-41872 Overview

CVE-2026-41872 is an improper certificate validation flaw [CWE-295] in the Kura Sushi Official App provided by EPG, Inc. The application fails to correctly validate TLS server certificates during push notification communication with its backend. An attacker positioned between the device and the server can intercept, read, or modify push notification traffic. The flaw affects both iOS and Android builds of the application distributed through the Apple App Store and Google Play Store.

Critical Impact

A network-positioned attacker can perform a man-in-the-middle (MITM) attack to eavesdrop on or alter push notification content exchanged between the Kura Sushi Official App and its server.

Affected Products

• Kura Sushi Official App for iOS (EPG, Inc.)
• Kura Sushi Official App for Android (EPG, Inc.)
• Push notification communication channel of the application

Discovery Timeline

• 2026-05-12 - CVE-2026-41872 published to the National Vulnerability Database (NVD)
• 2026-05-12 - Last updated in NVD database
• Coordinated disclosure - Advisory published as JVN Security Advisory JVN38632731

Technical Details for CVE-2026-41872

Vulnerability Analysis

The vulnerability stems from improper certificate validation [CWE-295] in the push notification communication path of the Kura Sushi Official App. The client does not properly verify the authenticity of the TLS certificate presented by the remote server. As a result, the application accepts certificates that should be rejected, including self-signed or attacker-controlled certificates. This breaks the trust model that TLS is designed to provide for confidentiality and integrity.

Push notifications often carry promotional content, reservation status, queue position, and account-related messages. When the channel is not properly authenticated, an attacker can inject or modify message content delivered to the user. The flaw is exploitable over the network without authentication and without user interaction, which significantly broadens the attack surface on hostile networks.

Root Cause

The root cause is a failure to enforce strict certificate chain validation, hostname verification, or certificate pinning during the TLS handshake used for push notification traffic. Such issues typically arise from custom TrustManager or URLSession delegate implementations that override default validation logic, or from disabled hostname checks in the underlying HTTP client.

Attack Vector

Exploitation requires the attacker to be positioned on the network path between the mobile device and the push notification server. Common scenarios include malicious public Wi-Fi access points, ARP spoofing on a local network, rogue cellular base stations, or compromised upstream network equipment. Once positioned, the attacker presents a fraudulent TLS certificate. Because the application does not validate it correctly, the encrypted session is terminated at the attacker, who then proxies, reads, or rewrites push notification data before forwarding it to the legitimate endpoint.

No verified proof-of-concept code is publicly available for this issue. Technical details are described in the JVN advisory referenced above.

Detection Methods for CVE-2026-41872

Indicators of Compromise

• Unexpected TLS certificates presented to mobile clients on the push notification hostname used by the Kura Sushi Official App.
• Mobile devices connecting to the app's backend through unknown proxy IP addresses or untrusted certificate authorities.
• Push notification content that does not match server-side delivery logs maintained by EPG, Inc.

Detection Strategies

• Inspect network traffic from mobile fleets for TLS sessions to the Kura Sushi backend that terminate at non-approved certificate issuers.
• Use mobile threat defense agents on managed devices to flag TLS interception, untrusted root CAs, and active MITM proxies.
• Correlate Wi-Fi association events with anomalous DNS resolutions for the application's backend hostnames.

Monitoring Recommendations

• Monitor enterprise-managed mobile devices for installation of unknown root certificates that could enable interception.
• Alert on connections to the application's backend from networks known to host captive portals or transparent TLS proxies.
• Track JVN and vendor channels for an updated fixed version and confirm rollout across managed device inventories.

How to Mitigate CVE-2026-41872

Immediate Actions Required

• Avoid using the Kura Sushi Official App on untrusted networks such as public Wi-Fi until a fixed version is installed.
• Use a trusted cellular connection or corporate VPN when interacting with the application to reduce MITM exposure.
• Review enterprise mobile device management policies to restrict installation of user-added root certificates.

Patch Information

Refer to JVN Security Advisory JVN38632731 for the vendor-coordinated fix status. Update the application to the latest version available on the Apple App Store or Google Play Store once EPG, Inc. publishes a patched release.

Workarounds

• Disable push notifications for the application until a patched version is deployed to reduce exposure of the affected channel.
• Enforce a VPN tunnel from managed mobile devices to a trusted egress point so that local network attackers cannot intercept TLS traffic.
• Educate users to avoid sensitive interactions with the app on networks they do not control or trust.

# Configuration example: enforce always-on VPN on managed Android devices via MDM
# (illustrative MDM policy keys - actual keys vary by MDM vendor)
always_on_vpn_package = "com.example.corp.vpn"
always_on_vpn_lockdown = true
user_ca_certs_install = "disallow"