EUVD-2026-71096Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall incompatible mkpasswd on build host
-
DeliveryRun Actualizer v1.2.0 installer
-
Exploitmkpasswd silently produces no yescrypt hash
-
ExecutionInstaller writes empty password field to /etc/shadow
-
PersistDeploy Debian image
-
ImpactAuthenticate as root or alpha with no password
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Return value checking
|
| Exploitation Conditions | The vulnerability triggers at BUILD time, not at runtime. Two specific conditions are required: (1) the build host must have an incompatible mkpasswd implementation - specifically, the makepasswd package installed instead of whois, or a libxcrypt version that does not support yescrypt hashing; and (2) the resulting image must be deployed on a system whose PAM configuration accepts empty shadow password fields as passwordless login (common in many default configurations). Exploitation at runtime is then unrestricted: any user who can reach an authentication interface (console, SSH, etc.) for the deployed image can log in as root or alpha without a password. The limiting factors are the niche product footprint, the need for a specific build-host misconfiguration, and the PAM configuration of the target deployment. |
| Impact | The provided CVSS 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) captures the scope-change dynamic well: a build-time flaw propagates into deployed images, affecting all users of those images. The S:C and C:H/I:H scoring is justified by the potential for passwordless root access on every deployed instance. However, AC:L may overstate ease: the failure condition requires an incompatible mkpasswd on the build host (wrong package or old libxcrypt), which is a specific, non-default misconfiguration rather than a trivially reproducible state. Assessed AC:H is more representative. Real-world impact is bounded by the product's niche footprint and the requirement that deployed images run PAM configurations that permit empty password fields. No KEV listing and no public exploit code identified; exploitation is opportunistic rather than automated. The risk is most acute for operators building images in CI/CD pipelines where build-host package selection may not be tightly controlled. |
| Exploit ScenarioDerived | A developer builds a Debian minbase image on a CI host where the makepasswd package is installed rather than whois, causing mkpasswd to produce output without yescrypt support. Actualizer v1.2.0 silently accepts the empty hash, writing passwordless entries into /etc/shadow for root and alpha. When the resulting image is deployed and SSH is exposed, an attacker with knowledge of this build condition connects as root with no password, achieving immediate full system compromise. No public exploit code is needed; the vulnerability is inherent to the flawed image. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1.
RemediationAI
Upgrade to Actualizer v1.2.1, available at https://github.com/ChewKeanHo/software-actualizer/releases/tag/v1.2.1, which introduces both a pre-flight yescrypt compatibility check and post-generation hash validation against the '$y$' prefix in each password loop. Any Debian images already built with v1.2.0 or earlier must be considered potentially compromised and should be rebuilt with v1.2.1 and redeployed. As a build-time workaround on existing versions, ensure the whois package (not makepasswd) provides the mkpasswd binary on the build host and that libxcrypt supports yescrypt before running the installer. Additionally, audit deployed images by inspecting /etc/shadow for root and alpha entries with empty password fields (a field consisting solely of colons); if empty fields are found, lock those accounts immediately with passwd -l or usermod -L and rebuild the image. The Zenodo publication at https://doi.org/10.5281/zenodo.22169659 provides additional disclosure context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Actualizer is a Debian minimal base image builder. Its installer script (Shell/debian-minbase-install.sh) calls mkpasswd with --method=yescrypt to hash passwords for the root and alpha accounts during the image build phase. CWE-252 (Unchecked Return Value) is the root cause: the script captures mkpasswd output into a shell variable but neither checks the command's exit code nor validates that the output begins with the yescrypt hash prefix '$y$'. On build hosts where the makepasswd package is installed instead of the whois package, or where libxcrypt is too old to support yescrypt, mkpasswd produces no usable output or fails silently. The script then writes the empty variable into the image's /etc/shadow, creating accounts with no password hash - a condition that many PAM configurations interpret as passwordless login. The fix in commit 50a0932 adds both a pre-flight mkpasswd compatibility probe (checking for '$y$' prefix on a test hash) and post-generation pattern matching on each hash variable before continuing.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
AC:H because triggering the flaw requires a specific non-default build-host misconfiguration (wrong mkpasswd package or old libxcrypt); all other metrics follow the vendor vector.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
DescriptionCVE.org
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.
Technical POC Analysis
The flaw is in Shell/debian-minbase-install.sh (v1.2.0 and earlier), in the password loops for the Alpha account (around line 788) and the root account (around line 851).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Actualizer v1.2.0 installer contains a fail-open password validation flaw that may produce Debian images with empty root and alpha account passwords when the build host has an incompatible mkpasswd implementation. Organizations using this installer to deploy infrastructure risk creating systems with passwordless root-level access, exposing deployed assets to direct compromise without valid credentials.
Apply vendor patch: Actualizer v1.2.1. Interim mitigations if immediate patching is delayed: (1) Force password prompt enforcement via PAM configuration on deployed systems; (2) disable root login via SSH and enforce certificate-based access; (3) implement network segmentation to restrict unprompted console access; (4) monitor authentication logs for passwordless login attempts to alert on compromise attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB