In blueprintUE Self-Hosted Edition before 4.3.7, the Docker Compose examples ship with an empty MariaDB root password and publish the database on port 3306, so anyone who can reach that port can take full control of the database without logging in.
What Is It
CVE-2026-126812 is an insecure default configuration (CWE-258: Empty Password in Configuration File) in the Docker Compose examples for blueprintUE Self-Hosted Edition. The example database.env file sets MYSQL_ALLOW_EMPTY_PASSWORD=yes, and the Compose configuration publishes MariaDB on port 3306. An unauthenticated attacker who can reach the Docker host on port 3306 can log in as root with no password.
VulnCheck disclosed the issue, and NVD published it on 2026-11-11. The NVD record is currently in "Received" status.
Why It Matters
Root access to the database lets an attacker read, change, or delete user accounts, blueprints, and every database on the server. The vendor-assigned scores reflect that:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
The attack works over the network, is low complexity, and needs no privileges or user interaction. Confidentiality, integrity and availability impacts are all rated High.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the supplied data does not confirm active exploitation.
What's Vulnerable
- Product: blueprintUE Self-Hosted Edition (
pkg:github/blueprintue/blueprintue-self-hosted-edition) - Affected versions: 1.0.0 up to, but not including, 4.3.7
- Affected component: the Docker Compose examples, specifically
docker-examples/database.envand the MariaDB service definition. The v4.3.6docker-compose-smtp.ymlfile is one referenced example.
The risk applies to deployments built from these examples where port 3306 on the Docker host can be reached by an attacker.
Patch Status
Version 4.3.7 fixes the issue, through upstream commit e6a6e1d and pull request #270. Upgrade to 4.3.7 or later. If your deployment was built from the earlier Docker examples, check that its database configuration no longer allows an empty root password and that MariaDB is not published on port 3306. Upgrading the application alone may not change a deployment that was already set up from the old examples. CISA has not issued a required action because the CVE is not listed in KEV.