{"id":"CVE-2026-126812","kind":"vulnerability","aliases":["CVE-2026-126812"],"related":[],"title":"blueprintUE Self-Hosted: default Docker config lets anyone log in as database root","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","summary":"The Docker Compose examples for blueprintUE Self-Hosted Edition set MariaDB to allow an empty root password and publish port 3306. An attacker who can reach that port can log in as root and read, change or delete accounts, blueprints and all databases.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"blueprintUE Self-Hosted Edition","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["blueprintup","docker","mariadb","other","self-hosted"],"not_affected_if":["managed-hosting","port-3306-not-published","root-password-set"],"how_to_check":null,"fix":"- blueprintUE Self-Hosted Edition: move to `4.3.7` or later.","status":"open","published_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:32+00:00","updated_at":"2026-11-11T21:30:32+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T21:30:32Z","model":"claude-haiku-5-5","output":{"fix":"- blueprintUE Self-Hosted Edition: move to `4.3.7` or later.","reach":"network","title":"blueprintUE Self-Hosted: default Docker config lets anyone log in as database root","impact":"high","summary":"The Docker Compose examples for blueprintUE Self-Hosted Edition set MariaDB to allow an empty root password and publish port 3306. An attacker who can reach that port can log in as root and read, change or delete accounts, blueprints and all databases.","audience":"businesses","category":"other","nicknames":[],"who_cares":["blueprintup","self-hosted","docker","mariadb"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as database root and reads or deletes all data","analyst_note":"","how_to_check":"- Look for `MYSQL_ALLOW_EMPTY_PASSWORD=yes` in the `database.env` file of your blueprintUE deployment.\n- Check whether port `3306` is published on the Docker host (look for `3306:3306` in the compose file, or run `docker ps` and look for `0.0.0.0:3306`).\n- Check the blueprintUE version in use; versions before `4.3.7` are affected.","plain_action":"","product_name":"blueprintUE Self-Hosted Edition","needs_analyst":false,"not_affected_if":["managed-hosting","port-3306-not-published","root-password-set"],"who_is_affected":"Teams that run blueprintUE Self-Hosted Edition from the project's Docker Compose examples on a Docker host reachable by others. The exposure comes from the default database.env setting and the published MariaDB port; deployments that do not publish port 3306 or that set a root password are not exposed by this default. unknown whether other configurations are affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000802,"input_tokens":4674,"output_tokens":669,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126812':17A,20A '-2026':16A,19A '3306':54B,108C,117C '4.3.7':83C 'account':72B,132C 'allow':46B,97C 'anyon':9A 'attack':56B,110C 'blueprint':73B,133C 'blueprintu':1A,38B,77C 'blueprintue':21A 'blueprintup':26B 'chang':69B 'compos':35B,92C 'config':7A 'configur':88C 'contain':84C 'cve':15A,18A 'databas':13A,76B,136C 'database.env':102C 'default':5A,87C 'delet':71B,130C 'docker':6A,27B,34B,91C,113C 'edit':42B,81C 'edition':25A 'empti':48B,98C 'exampl':36B,93C 'host':4A,32B,41B,80C,114C 'hosted':24A 'insecur':86C 'let':8A 'log':10A,63B,119C 'mariadb':28B,44B,105C 'modifi':128C 'mysql':96C 'password':50B,99C,125C 'port':53B,61B,107C,116C 'publish':52B,104C 'reach':59B,111C 'read':68B,127C 'root':14A,49B,66B,122C 'self':3A,23A,31B,40B,79C 'self-host':2A,30B,39B,78C 'self-hosted':22A 'set':43B,95C 'unauthent':109C 'user':131C 'without':123C 'yes':100C","nicknames":[],"mitigations":[],"who_affected":"Teams that run blueprintUE Self-Hosted Edition from the project's Docker Compose examples on a Docker host reachable by others. The exposure comes from the default database.env setting and the published MariaDB port; deployments that do not publish port 3306 or that set a root password are not exposed by this default. unknown whether other configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["blueprintueselfhostededition","selfhostededition"],"ptokens":["blueprintue","edition","hosted","self"],"labels":["blueprintup","critical","docker","mariadb","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126812':17A,20A '-2026':16A,19A 'anyon':9A 'blueprintu':1A 'blueprintue':21A 'config':7A 'cve':15A,18A 'databas':13A 'default':5A 'docker':6A 'edition':25A 'host':4A 'hosted':24A 'let':8A 'log':10A 'root':14A 'self':3A,23A 'self-host':2A 'self-hosted':22A","search_b":"'3306':54B 'account':72B 'allow':46B 'attack':56B 'blueprint':73B 'blueprintu':38B 'blueprintup':26B 'chang':69B 'compos':35B 'databas':76B 'delet':71B 'docker':27B,34B 'edit':42B 'empti':48B 'exampl':36B 'host':32B,41B 'log':63B 'mariadb':28B,44B 'password':50B 'port':53B,61B 'publish':52B 'reach':59B 'read':68B 'root':49B,66B 'self':31B,40B 'self-host':30B,39B 'set':43B","search_c":"'3306':108C,117C '4.3.7':83C 'account':132C 'allow':97C 'attack':110C 'blueprint':133C 'blueprintu':77C 'compos':92C 'configur':88C 'contain':84C 'databas':136C 'database.env':102C 'default':87C 'delet':130C 'docker':91C,113C 'edit':81C 'empti':98C 'exampl':93C 'host':80C,114C 'insecur':86C 'log':119C 'mariadb':105C 'modifi':128C 'mysql':96C 'password':99C,125C 'port':107C,116C 'publish':104C 'reach':111C 'read':127C 'root':122C 'self':79C 'self-host':78C 'set':95C 'unauthent':109C 'user':131C 'without':123C 'yes':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T16:04:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126812","severity":null,"published_at":"2026-11-11T21:16:45+00:00","modified_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128992,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/e6a6e1d4c2f22efbbabf9fb31ec479544405b469","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128993,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128994,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-9f6r-vjc7-jq67","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T16:04:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128995,"url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.7-empty-mariadb-root-password-via-docker-compose","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}