Correction: an identifier taken from a responder's account was recorded as fact
Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.
- id
- CHQ-CORR-2026-040
- class
- CORRECTION
- subtype
- editorial
- status
- IN FORCE
- authority
- DM ratified 2026-11-12
- effective
- 2026-11-12
- published
- 2026-11-12
- title
- Correction: an identifier taken from a responder's account was recorded as fact
- what was wrong
- A holding-queue item on a LiteLLM key-management flaw recorded CVE-2026-40217 as the flaw's identifier. That is the identifier a responder's account of 2 November 2026 attached to it.
- what is true
- The CVE record for CVE-2026-40217 describes a different flaw, code execution through a guardrails test function. Which identifier covers the key-management flaw the responder described is not established. A second identifier proposed by a reviewer was checked and not adopted, because its record describes something else again.
- what changed
- The item states the identifier as the source's attribution, with the discrepancy.
- what did not change
- No count, rating, Outlook or Watch. The item is in the holding queue, not admitted, and absent from the catalog. Nothing public named the identifier.
- control analysis
- A source's statement was carried as a record fact, the same class of error as CHQ-CORR-2026-027 and CHQ-CORR-2026-028. The rule restated: an identifier from a secondary or responder account is recorded as that source's attribution until the CVE record is read.
- found by
- An external review of a draft of Issue No. 46, verified by CHQ against the primaries. One part of the review's finding was not adopted.