CVE-2026-85649 in Software Actualizer
Summary
by MITRE • 09/04/2026
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Chew Kean Ho's Actualizer version 1.2.0 and earlier represents a critical fail-open condition within the system installation process, specifically located in the Shell/debian-minbase-install.sh script. This flaw affects both the Alpha user and root user password configuration loops during the image building phase. The core technical issue stems from an improper handling of command execution results when invoking mkpasswd to generate yescrypt password hashes. In secure software development practices, any external command that modifies security-critical state must have its return value validated to ensure successful completion before proceeding with subsequent operations that depend on that outcome. Here, the script fails to check whether mkpasswd successfully generated a valid hash or encountered an error condition such as missing dependencies or incompatible implementations.
When mkpasswd encounters an environment lacking yescrypt support or utilizes an incompatible version of the utility, it may fail silently or return an empty string rather than throwing a fatal exception that halts the build process. Because the script does not validate this output, it proceeds under the assumption that a valid hash was generated and stored in the password variable. Consequently, the resulting system image contains accounts with empty password fields for both the root user and the Alpha administrative account. This behavior constitutes a classic example of CWE-798: Use of Hard-coded Credentials, specifically manifesting as an unintended default state where authentication requirements are effectively nullified due to improper error handling rather than intentional design choice.
The operational impact of this vulnerability is severe, particularly for deployments that rely on the generated images in production environments. An empty password field typically allows login without any credentials if the underlying operating system's PAM configuration permits such access or if default authentication modules are configured to accept blank passwords as a fallback mechanism. This effectively grants unrestricted root and administrative access to anyone with physical or network-level access to the machine, bypassing all intended security controls. Attackers could exploit this by booting from removable media or accessing the system via console interfaces where no password is required for these specific accounts. The risk is amplified in automated deployment pipelines where images are built without manual review of intermediate logs, allowing vulnerable builds to propagate into production infrastructure undetected.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Privilege Escalation techniques by providing unauthenticated entry points with high-privilege accounts. It aligns with CWE-284: Improper Access Control, as the system fails to enforce authentication requirements due to flawed implementation logic. The failure is not in the cryptographic strength of yescrypt itself but in the procedural integrity of the installation script which assumes success without verification. This type of defect is often categorized under CWE-913: Improper Control of Dynamically-Identified Variables, where a variable intended to hold secure data ends up empty due to unchecked external input or command output.
Mitigation strategies must focus on enforcing strict error handling within the installation scripts. Developers should implement explicit checks for the return code of mkpasswd and abort the build process if hash generation fails. Additionally, integrating static analysis tools that detect unvalidated command outputs can help identify such patterns early in the development lifecycle. For existing deployments, immediate remediation involves patching to a version where this validation is present or manually verifying password hashes post-installation using standard Linux utilities like passwd or chpasswd to ensure no accounts have empty credentials. Regular audits of build scripts against secure coding standards are essential to prevent similar fail-open conditions in other system components.