CVE-2026-117477

Name of the Vulnerable Software and Affected Versions KUSANAGI versions 9.12.2-1 and earlier (Free, Business, and Premium editions) KUSANAGI versions 10.7.2-1 and earlier (Security and Enterprise editions) KUSANAGI versions 7 and 8

Description An HTTP header injection flaw exists due to a CRLF (Carriage Return Line Feed) injection in a redirect rule that the software writes into the Nginx configuration of each WordPress profile. This allows arbitrary HTTP headers to be injected into the server response when a user accesses a specially crafted URL. This issue can be leveraged for cache poisoning, cookie injection, or phishing redirects.

Recommendations Update Free, Business, and Premium editions to version 9.12.3-1 using dnf upgrade kusanagi. Update Security and Enterprise editions to version 10.7.3-1 using dnf upgrade kusanagi or via autoupdate. For versions 7 and 8, change the Nginx variable in the /wp-admin rewrite rule from uri to request uri and reload Nginx. As a temporary workaround for all affected versions, change the Nginx variable in the /wp-admin rewrite rule from uri to request uri and reload Nginx.