Vulnerability in Chewkeanho Software-Actualizer
CVE-2026-85649
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.9 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (9.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 9.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: -0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 5a6e4751-2f3f-4070-9419-94fb35b644e8 (technical-description)
- 5a6e4751-2f3f-4070-9419-94fb35b644e8
- 5a6e4751-2f3f-4070-9419-94fb35b644e8 (patch)
- 5a6e4751-2f3f-4070-9419-94fb35b644e8 (release-notes, patch)
Frequently asked questions
- What is CVE-2026-85649?
- CVE-2026-85649 is a high-severity vulnerability in Chewkeanho Software-Actualizer, classified under CWE-252. CVSS score: 7.9/10. Published 2026-09-04.
- How severe is CVE-2026-85649?
- High severity. CVSS v3 base score is 7.9 out of 10.
- Is CVE-2026-85649 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.