CVE-2026-85649
Received Received - Intake

Hard-Coded Password in Actualizer Installer

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: CIRCL

Description
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85649
EUVD
EUVD-2026-71096

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
chew_kean_ho actualizer 1.2.0
chew_kean_ho software_actualizer *
chewkeanho software_actualizer 1.2.0
chewkeanho software_actualizer 1.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a fail-open password validation flaw in Actualizer v1.2.0 and earlier. The installer script Shell/debian-minbase-install.sh uses mkpasswd to generate yescrypt password hashes but fails to check if the command succeeds. If mkpasswd cannot generate a valid hash due to missing yescrypt support or an incompatible implementation, the password hash variable becomes empty. This allows the build to proceed with empty password fields for root and alpha accounts, potentially enabling passwordless authentication depending on system configuration.

Detection Guidance

Check if the software-actualizer v1.2.0 or earlier is installed by examining the build script Shell/debian-minbase-install.sh for the mkpasswd yescrypt validation flaw. Verify if mkpasswd generates empty hashes by running mkpasswd --method=yescrypt and checking for output. Inspect system images for empty password fields in root and alpha accounts.

Impact Analysis

If you use or deploy images built with affected versions of Actualizer, attackers could gain unauthorized access via passwordless root or alpha accounts. This could lead to full system compromise, data theft, or further network infiltration. The impact depends on the authentication configuration of the deployed system.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication and access controls, such as GDPR's security principles or HIPAA's safeguards for protected health information. Unauthorized access risks data breaches, leading to potential regulatory penalties, reputational damage, and legal consequences for organizations failing to protect sensitive data.

Mitigation Strategies

Upgrade to software-actualizer v1.2.1 or later which includes the empty password hash check. Ensure mkpasswd supports yescrypt by installing the correct package (e.g., 'whois' instead of 'makepasswd'). Manually verify password hashes in built images are non-empty for root and alpha accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart