From 397d2c5d1954afbe5d3fcf276ae82ad2a00e5e8e Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 11 May 2026 13:52:52 +0200
Subject: [PATCH 38/38] CVE-2026-4408: docs-xml/smbdotconf: clarify '%u' in
 'check password script'

Admins should use SAMBA_CPS_ACCOUNT_NAME.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---
 docs-xml/smbdotconf/security/checkpasswordscript.xml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/docs-xml/smbdotconf/security/checkpasswordscript.xml b/docs-xml/smbdotconf/security/checkpasswordscript.xml
index 18aa2c6d290..dd162d89f08 100644
--- a/docs-xml/smbdotconf/security/checkpasswordscript.xml
+++ b/docs-xml/smbdotconf/security/checkpasswordscript.xml
@@ -20,8 +20,8 @@
 
     <itemizedlist>
 	<listitem><para>
-	SAMBA_CPS_ACCOUNT_NAME is always present and contains the sAMAccountName of user,
-	the is the same as the %u substitutions in the none AD DC case.
+	SAMBA_CPS_ACCOUNT_NAME is always present and contains the sAMAccountName of user.
+	It is the same as the '%u' substitutions in the non AD DC case.
 	</para></listitem>
 
 	<listitem><para>
@@ -33,6 +33,12 @@
 	</para></listitem>
     </itemizedlist>
 
+    <para>Even on a non AD DC SAMBA_CPS_ACCOUNT_NAME is the preferred way to access the
+    account name, as it contains the raw value provided by the client. If that's not
+    possible you should use single quotes (directly) around %u, e.g. /path/to/somescript '%u',
+    see CVE-2026-4408 for more details.
+    </para>
+
     <para>Note: In the example directory is a sample program called <command moreinfo="none">crackcheck</command>
     that uses cracklib to check the password quality.</para>
 
-- 
2.43.0

