---
id: "CVE-2026-126812"
page: "https://infrastack.ai/live/CVE-2026-126812"
kind: "vulnerability"
aliases: ["CVE-2026-126812"]
title: "blueprintUE Self-Hosted: default Docker config lets anyone log in as database root"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "blueprintUE Self-Hosted Edition", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["blueprintup", "docker", "mariadb", "other", "self-hosted"]
not_affected_if: ["managed-hosting", "port-3306-not-published", "root-password-set"]
published_at: "2026-11-11T21:16:45+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:30:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126812", "first_seen_at": "2026-11-11T21:29:08+00:00"}]
exploit_sources: []
---

# blueprintUE Self-Hosted: default Docker config lets anyone log in as database root

Link for people: https://infrastack.ai/live/CVE-2026-126812 (this .md is for agents)

The Docker Compose examples for blueprintUE Self-Hosted Edition set MariaDB to allow an empty root password and publish port 3306. An attacker who can reach that port can log in as root and read, change or delete accounts, blueprints and all databases.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:blueprintUE Self-Hosted Edition affected range not listed fixed no fixed version listed

## Fix

- blueprintUE Self-Hosted Edition: move to `4.3.7` or later.

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126812

## Documents

- [advisory] Vendor advisory: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-9f6r-vjc7-jq67
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.7-empty-mariadb-root-password-via-docker-compose
- [fix] Patch: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/e6a6e1d4c2f22efbbabf9fb31ec479544405b469
- [fix] Release notes: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.7

## From the sources

blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_