CVE-2026-85649: Actualizer Fail-Open Auth Bypass Flaw

CVE-2026-85649 Overview

CVE-2026-85649 is a fail-open password validation flaw in (Holloway) Chew, Kean Ho's Actualizer version 1.2.0 and earlier. The Shell/debian-minbase-install.sh installer invokes mkpasswd to generate yescrypt password hashes for the root and alpha accounts but does not verify the command's exit status. When mkpasswd fails, for example on hosts without yescrypt support or with an incompatible implementation, the password hash variable remains empty. The build proceeds and produces a Debian minbase image containing empty password fields for privileged accounts. Depending on the target authentication configuration, the image can allow passwordless authentication as root or alpha. The issue is classified under [CWE-252: Unchecked Return Value].

Critical Impact
Built images can ship with empty password hashes for root and alpha, enabling passwordless privileged access where PAM permits empty passwords.

Affected Products

(Holloway) Chew, Kean Ho's Actualizer version 1.2.0
Actualizer releases prior to 1.2.0 that include Shell/debian-minbase-install.sh
Debian minbase images built using the vulnerable installer script

Discovery Timeline

2026-09-04 - CVE-2026-85649 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-85649

Vulnerability Analysis

The defect resides in the Alpha user and root user password loops within Shell/debian-minbase-install.sh. The installer calls mkpasswd to produce a yescrypt hash and assigns the result to a shell variable. It does not test the command's return status or validate that the output begins with the yescrypt identifier $y$. When mkpasswd writes nothing to standard output, the assignment silently succeeds with an empty string.

The empty value is then written into the image's shadow entries for root and alpha. On systems where PAM is configured with nullok or equivalent, an empty shadow field is treated as a valid credential and grants login without a password. Attackers with local access to the built image can therefore obtain interactive privileged shells.

Root Cause

The root cause is a missing return-value check on an external command whose output is used as security-critical material. Two conditions trigger the failure: the makepasswd package is installed in place of whois, or the host's libxcrypt is too old to support yescrypt. In both cases mkpasswd --method=yescrypt exits non-zero and produces no hash, yet the build continues.

Attack Vector

Exploitation requires local access to a system provisioned from an image built by a vulnerable Actualizer host. An attacker with a console, virtual TTY, or other local authentication surface attempts to log in as root or alpha and submits an empty password. Where the authentication stack permits empty passwords, the login succeeds and the attacker gains privileged access. The vulnerability affects integrity and confidentiality of the deployed image rather than the build host.

bash

# Security patch in Shell/debian-minbase-install.sh (v1.2.1)
                unset ____line ____old_IFS
                exit 1
        fi


        # CVE-TBD: ensure the mkpasswd has yescrypt support.
        if [ "$____line" = "mkpasswd" ]; then
                # simulate mkpasswd check
                ____temp="$(printf "%s" "test" \
                        | mkpasswd --method=yescrypt --stdin \
                        2> /dev/null
                )"

                case "$____temp" in
                '$y$'*)
                        # all good - accepted
                        unset ____temp
                        ;;
                *)
                        # reject build from any outdated or incompatible host
                        # os.
                        unset ____temp
                        1>&2 printf -- "%s" "\
E: The installed 'mkpasswd' does not support 'yescrypt' hashing.
E:
E: This usually happens if:
E:   (1) the 'makepasswd' package is installed instead of 'whois'; AND/OR
E:   (2) your host's libxcrypt is incompatible or too old.
E:
E: This can yield severe security vulnerability for the built image.

Source: GitHub Commit Patch

Detection Methods for CVE-2026-85649

Indicators of Compromise

Entries in /etc/shadow for root or alpha with an empty password field (root::... or alpha::...) inside built images.
Build logs from debian-minbase-install.sh showing successful completion without a $y$-prefixed hash string.
Presence of the makepasswd package on the Actualizer build host instead of whois, or a libxcrypt version lacking yescrypt support.

Detection Strategies

Scan produced Debian minbase images with awk -F: '($2=="") {print}' /etc/shadow to enumerate accounts with empty hashes.
Verify PAM configuration files for nullok on pam_unix.so in generated images, which converts the defect into a login bypass.
Compare Actualizer version metadata against 1.2.0 and earlier across CI/CD pipelines that call debian-minbase-install.sh.

Monitoring Recommendations

Audit successful root and alpha interactive logins on hosts deployed from Actualizer-built images.
Alert on shell process creation with parent login or sshd sessions that authenticated without a password prompt event.
Track new image artifacts in registries and repositories for shadow files containing empty privileged-account hashes.

How to Mitigate CVE-2026-85649

Immediate Actions Required

Upgrade Actualizer to version 1.2.1 or later before running any further Debian minbase builds.
Rebuild and redeploy any images produced by Actualizer 1.2.0 or earlier after confirming the build host has yescrypt-capable mkpasswd.
Rotate credentials and inspect /etc/shadow on all systems provisioned from vulnerable image builds.

Patch Information

The fix ships in Actualizer v1.2.1. The GitHub Commit Patch adds a pre-flight check that pipes a test string into mkpasswd --method=yescrypt --stdin and aborts the build unless the output begins with the yescrypt marker $y$. See the GitHub Release v1.2.1 notes and the vulnerable source at the GitHub Shell Script for reference.

Workarounds

Install the whois package on the build host so that mkpasswd provides yescrypt support, then rerun the installer.
Remove any makepasswd package that shadows the whois-provided mkpasswd binary in PATH.
Post-process built images to lock root and alpha with passwd -l or set explicit hashes before distribution.