CVE-2026-85649 | (Holloway) Chew, Kean Ho's Knowledge Research

On 2026-08-26, a security vulnerability (CVSS: 7.9, High[7]) was reported in (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and below. The tool assumed that the mkpasswd command always produces a valid yescrypt password hash. In situations where the installed mkpasswd lacks yescrypt support, the command instead fails and yields an empty value. Due to this logic flaw, the empty value was passed through unchecked and ended up as the password in the built image. As a result, both the root and alpha user accounts of the downstream image permit password-less login. This means v1.2.0 and below are vulnerable to:

CWE-636: "Not Failing Securely (Failing Open)" — primary defect[2]; AND
CWE-252: "Unchecked Return Value" — secondary defect[3].

The remedy was developed and published as (Holloway) Chew, Kean Ho's Actualizer v1.2.1 on 2026-08-27 ahead of public disclosure. Users only need to use v1.2.1 and above — that is all. Beyond that, this research paper documents the entire security incident in detail for educational and reference purposes only.

Verifying Content Integrity

To secure the content from unauthorized modification by anyone down to bit-level (0|1), they are cryptographically signed using one or more cryptography tools such as but not limited to:

GnuPG; AND/OR
OpenSSL.

The public key and the associated certificate are attached. Only the main owner keeps and maintains the private keys. To verify the content's integrity:

GnuPG

Install GnuPG software if not present.
Download the target file and its detached signature file (the .asc file with the same filename).
Download the public key file (.gpg).
Place them next to each other in the directory.
Open a terminal and execute the following command:

$ gpg --no-default-keyring --keyring /path/to/public.gpg --verify /path/to/file.asc

OpenSSL

Install OpenSSL software if not present.
Download the target file and its detached signature file (the .sig/.sign file with the same filename).
Download the public certificate file (.pem) containing the public key within.
Place them next to each other in the directory.
Open a terminal and execute the following command:

$ openssl dgst -verify /path/to/pubkey.pem -signature /path/to/file.sig /path/to/file

Artificial Intelligence (A.I.) Decrees

Please refer to AI_DECREES.md for the project's policy on the use of Artificial Intelligence.

Maintainers' Notes

Please refer to CONTRIBUTING.md for contributing & maintenances guidelines.

License

This entire repository is licensed under Creative Commons Attribution-NoDerivatives 4.0 International License. To ensure better understanding of this license, the following sub-sections will briefly describe how to deploy the content.

For registered non-profit organizations (NGO), you are considered a Commercial Entity the same as any for-profit organization by default. However, you will be eligible for the NGO disbursement grant and receive exception privileges from the creator(s).

Attribution

Unless otherwise specified in writing, you MUST attribute back to the creator(s) as follows:

Title: CVE-2026-85649
Creators: (Holloway) Chew, Kean Ho
Packaged-By: (Holloway) Chew, Kean Ho
Contact: [email protected]
CVD ID: CVE-2026-85649
GCVE ID: GCVE-1-2026-20023
GitHub Advisory ID: GHSA-3757-943V-G3C5
SKU: chewkeanho-research-cve-2026-85649
UUID: A90E844A-9BB6-483A-AAEC-2C77C9C3649F
DOI: 10.5281/zenodo.22169659
License: Creative Commons Attribution-NoDerivatives 4.0 International License (https://creativecommons.org/licenses/by-nd/4.0)
Repository Made On: 2026-08-31
Repository Made From: Malaysia, South East Asia
Procure: https://doi.org/10.5281/zenodo.22169659

Ownership - Personal

[!NOTE]

This targets any customer wanting to own a copy of the content and then only he/she is using it without sharing with any 3rd-party entity; AND WITHOUT any monetary intention such as but not limited to:

Saving a local copy and then viewing via his/her own mobile device(s); OR

Saving a local copy and then viewing via his/her own personal computer; OR

Saving a local copy for artificial intelligence data training purposes.

You are ALLOWED provided that you STRICTLY COMPLY with the license attribution.

Ownership - Commercial

[!NOTE]

This targets any customer wanting to own a copy of the content and then only he/she is using it without sharing with any 3rd-party entity; AND WITH any monetary intention such as but not limited to:

Saving a local copy for enhancing his/her company's procurement list; OR

Saving a local copy for commercial artificial intelligence data training purposes.