BLUEPRINTUE SELF-HOSTED EDITION · CVE-2026-126812 · Other
NO FIX YET · SEE WHAT TO DO
The Docker Compose examples for blueprintUE Self-Hosted Edition set MariaDB to allow an empty root password and publish port 3306. An attacker who can reach that port can log in as root and read, change or delete accounts, blueprints and all databases.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run blueprintUE Self-Hosted Edition from the project's Docker Compose examples on a Docker host reachable by others. The exposure comes from the default database.env setting and the published MariaDB port; deployments that do not publish port 3306 or that set a root password are not exposed by this default. unknown whether other configurations are affected.
Not affected if managed-hosting, port-3306-not-published, root-password-set
Who cares blueprintup, docker, mariadb, self-hosted
Unknown from the sources.
4.3.7 or later.blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.