CVE-2026-85649

Holloway Actualizer v1.2.0 and earlier contains a fail-open password validation flaw (unchecked return value, CWE-252/CWE-636) in the root and alpha user password loops of its Shell/debian-minbase-install.sh script, which invokes mkpasswd to generate yescrypt password hashes but never checks whether the command succeeded. If mkpasswd fails — for example under an incompatible mkpasswd implementation or in an environment without yescrypt support — the empty password hash variable is accepted unconditionally and the image build proceeds anyway. The resulting images can ship with empty password fields for the root and alpha accounts, so an attacker with local or login access to a system built from such an image could authenticate to those accounts without a password, potentially gaining full root privileges depending on the authentication configuration. Only operators who build Debian images with the affected versions of Actualizer are exposed, specifically those whose build environment lacked yescrypt-capable mkpasswd. No public proof-of-concept, CISA KEV listing, or reported exploitation exists; EPSS estimates only a 0.2% probability of exploitation in the next 30 days (11th percentile), with a CVSS 3.1 base score of 7.9 (high).

What to do: Discontinue building images with Actualizer v1.2.0 or earlier, or add a build-time check that mkpasswd returned a yescrypt hash before proceeding, and update to a release newer than 1.2.0 with the return-value check once available. Audit every system or image previously built with the affected script by inspecting the shadow file (e.g., /etc/shadow) for empty password fields on the root and alpha accounts; set strong passwords or lock any accounts found with empty hashes. Restrict console and remote login access to suspect systems until remediation is confirmed.