Cpe:2.3:a:blueprintue:self_hosted_edition:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ablueprintueself_hosted_edition/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:07:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgblueprintUE Self-Hosted Edition: Insecure default database configuration (CVE-2026-126812)https://feed.craftedsignal.io/briefs/2026-11-blueprintue-insecure-config-cve-2026-126812/Wed, 11 Nov 2026 22:07:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-blueprintue-insecure-config-cve-2026-126812/An insecure default configuration in blueprintUE Self-Hosted Edition before 4.3.7 allows unauthenticated remote attackers to gain root access to the database via exposed and unauthenticated MariaDB ports.blueprintUE Self-Hosted Edition before version 4.3.7 utilizes insecure default configurations within its provided Docker Compose examples. Specifically, the configuration sets the environment variable MYSQL_ALLOW_EMPTY_PASSWORD to 'yes' and exposes the MariaDB service on port 3306. This misconfiguration allows unauthenticated attackers with network access to the Docker host to connect to the database as the root user without credentials.

Impact

Successful exploitation results in full administrative access to the MariaDB instance. An attacker can read, modify, or delete all stored data, including user accounts, blueprint files, and entire databases, leading to complete compromise of the self-hosted application's data layer.

Recommendation

  • Upgrade to blueprintUE Self-Hosted Edition 4.3.7 or later immediately to utilize patched Docker configuration templates.
  • Audit existing Docker Compose deployments for blueprintUE and manually disable the 'MYSQL_ALLOW_EMPTY_PASSWORD' option by setting it to 'no'.
  • Restrict inbound network access to port 3306 on the Docker host to authorized IP addresses only using host-based firewalls or network access control lists.
]]>criticaladvisory