# Correction: an identifier taken from a responder's account was recorded as fact

- **Artifact ID:** CHQ-CORR-2026-040
- **Status:** IN FORCE
- **Public record:** https://record.cybersecurityhq.com/corrections/chq-corr-2026-040
- **Machine-record SHA-256:** `ebb9f2cc34c1cf5429da63bf5392d6a872f64a71e51c6c556688601484b59c82`

## Complete structured record

```json
{
  "id": "CHQ-CORR-2026-040",
  "class": "CORRECTION",
  "subtype": "editorial",
  "status": "IN FORCE",
  "authority": "DM ratified 2026-11-12",
  "effective": "2026-11-12",
  "published": "2026-11-12",
  "title": "Correction: an identifier taken from a responder's account was recorded as fact",
  "what_was_wrong": "A holding-queue item on a LiteLLM key-management flaw recorded CVE-2026-40217 as the flaw's identifier. That is the identifier a responder's account of 2 November 2026 attached to it.",
  "what_is_true": "The CVE record for CVE-2026-40217 describes a different flaw, code execution through a guardrails test function. Which identifier covers the key-management flaw the responder described is not established. A second identifier proposed by a reviewer was checked and not adopted, because its record describes something else again.",
  "what_changed": "The item states the identifier as the source's attribution, with the discrepancy.",
  "what_did_not_change": "No count, rating, Outlook or Watch. The item is in the holding queue, not admitted, and absent from the catalog. Nothing public named the identifier.",
  "control_analysis": "A source's statement was carried as a record fact, the same class of error as CHQ-CORR-2026-027 and CHQ-CORR-2026-028. The rule restated: an identifier from a secondary or responder account is recorded as that source's attribution until the CVE record is read.",
  "found_by": "An external review of a draft of Issue No. 46, verified by CHQ against the primaries. One part of the review's finding was not adopted."
}
```