CVE-2026-126812— blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose

Quick assessment

Affected

blueprintue blueprintue-self-hosted-edition

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

blueprintUE 自托管版 4.3.7 之前版本在其 Docker Compose 示例配置中存在不安全的默认设置：在文件中将设置为，并将 MariaDB 数据库监听端口 3306 对外发布。任何能够访问 Docker 主机 3306 端口的未认证攻击者，均可无需密码以 root 身份登录数据库，进而读取、修改或删除用户账户、蓝图（blueprints）以及所有数据库中的数据。

CVSS 9.8 · Critical Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose

Source: CVE Program / CVE List V5

Vulnerability Description

blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

配置文件中缺省空口令

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
blueprintue	blueprintue-self-hosted-edition	1.0.0 ~ 4.3.7	-

II. Public POCs for CVE-2026-126812

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126812

请登录查看更多情报信息。

Other References for CVE-2026-126812 (7)

https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/database.env technical-description
https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/e6a6e1d4c2f22efbbabf9fb31ec479544405b469 patch
https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/270 issue-tracking patch
https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/docker-compose-smtp.yml#L14-L24 technical-description
https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-9f6r-vjc7-jq67 vendor-advisory
https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.7 release-notes
https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.7-empty-mariadb-root-password-via-docker-compose third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126812

Same Patch Batch · blueprintue · 2026-11-11 · 3 CVEs total

CVE-2026-126659	7.5 HIGH	BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 Storage Exhaustion via Anonymous Bluepr
CVE-2026-126814	3.5 LOW	blueprintUE Self-Hosted Edition before 4.3.6 Arbitrary Iframe Embedding via PeerTube Match

IV. Related Vulnerabilities

Same product: blueprintue-self-hosted-edition

Same vendor: blueprintue

Same weakness: CWE-258