blueprintUE Self-Hosted Edition: Insecure default database configuration (CVE-2026-126812)
An insecure default configuration in blueprintUE Self-Hosted Edition before 4.3.7 allows unauthenticated remote attackers to gain root access to the database via exposed and unauthenticated MariaDB ports.
CVE search metadata
CVE search record: CVE-2026-126812. Severity: critical. CVSS: 9.8. KEV: no. Product: blueprintUE Self-Hosted Edition (< 4.3.7). Brief: blueprintUE Self-Hosted Edition: Insecure default database configuration (CVE-2026-126812). Brief link: https://feed.craftedsignal.io/briefs/2026-11-blueprintue-insecure-config-cve-2026-126812/
Triage facts
Revision 1- Applicability
- blueprintUE Self-Hosted Edition (< 4.3.7)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
blueprintUE Self-Hosted Edition before version 4.3.7 utilizes insecure default configurations within its provided Docker Compose examples. Specifically, the configuration sets the environment variable MYSQL_ALLOW_EMPTY_PASSWORD to 'yes' and exposes the MariaDB service on port 3306. This misconfiguration allows unauthenticated attackers with network access to the Docker host to connect to the database as the root user without credentials.
Impact
Successful exploitation results in full administrative access to the MariaDB instance. An attacker can read, modify, or delete all stored data, including user accounts, blueprint files, and entire databases, leading to complete compromise of the self-hosted application's data layer.
Recommendation
- Upgrade to blueprintUE Self-Hosted Edition 4.3.7 or later immediately to utilize patched Docker configuration templates.
- Audit existing Docker Compose deployments for blueprintUE and manually disable the 'MYSQL_ALLOW_EMPTY_PASSWORD' option by setting it to 'no'.
- Restrict inbound network access to port 3306 on the Docker host to authorized IP addresses only using host-based firewalls or network access control lists.
Immediate actions
Inventory all internal instances of blueprintUE Self-Hosted Edition to identify those using the default Docker Compose configuration.
Upgrade affected deployments to version 4.3.7 or later.
Threat Hunt
Identify unauthorized connection attempts to port 3306 on hosts running blueprintUE containers.
Data: Netflow data, Firewall logs
Mitigations
Restrict network access to port 3306 from external subnets.
CVE-2026-126812