From e9feb47a1ca80e3fdd6cf2e3ab5b04b8aed2ac75 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 8 May 2026 23:27:35 +0200
Subject: [PATCH 25/27] CVE-2026-4408: s3:testparm: warn about 'check password
 script' %u usage

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---
 source3/utils/testparm.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
index 72579fff39e..abd99da9ca1 100644
--- a/source3/utils/testparm.c
+++ b/source3/utils/testparm.c
@@ -265,6 +265,7 @@ static int do_global_checks(void)
 	const char *socket_options;
 	const struct loadparm_substitution *lp_sub =
 		loadparm_s3_global_substitution();
+	const char *check_pw_script = NULL;
 
 	fprintf(stderr, "\n");
 
@@ -688,6 +689,18 @@ static int do_global_checks(void)
 			"CVE-2022-37966\n\n");
 	}
 
+
+	check_pw_script = lp_check_password_script(talloc_tos(), lp_sub);
+	if (talloc_string_sub_mixed_quoting(check_pw_script, 'u')) {
+		fprintf(stderr,
+			"WARNING: You are using 'check password script' "
+			"with mixed quoting and %%u.\n"
+			"CVE-2026-4408 changed the way %%u substitution works. \n"
+			"You should use the SAMBA_CPS_ACCOUNT_NAME "
+			"environment variable exported to the script, or\n"
+			"at least use single quotes (directly) around '%%u'.\n\n");
+	}
+
 	return ret;
 }
 
-- 
2.43.0


