CVE-2026-126812: blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose

Published Nov 11, 2026

Updated

blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQLALLOWEMPTYPASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade blueprintUE Self-Hosted Edition to a version that resolves this vulnerability.
Fixed in 4.3.7
Configuration
Change MYSQL_ALLOW_EMPTY_PASSWORD from yes to no in database.env.
MariaDB Docker Compose configuration MYSQL_ALLOW_EMPTY_PASSWORD = no

Event History

Nov 11, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated compromise?

Self-Hosted Edition deployments before 4.3.7 are exposed when they use the affected Docker Compose examples, retain MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env, and make MariaDB reachable on the Docker host's port 3306.

What does an attacker need to exploit this issue?

An attacker only needs network access to port 3306 on the Docker host. No credentials or user interaction are required because the MariaDB root account can be accessed with an empty password.

What can an attacker do after connecting?

An attacker can log in as the MariaDB root user and read, modify, or delete user accounts, blueprints, and all databases.

How can I check whether a deployment is affected?

Review database.env for MYSQL_ALLOW_EMPTY_PASSWORD=yes and verify whether MariaDB is published or otherwise reachable through port 3306 on the Docker host. Deployments before 4.3.7 using those Docker Compose settings should be treated as affected.

CVE-2026-126812: blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated compromise?

What does an attacker need to exploit this issue?

What can an attacker do after connecting?

How can I check whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated compromise?

What does an attacker need to exploit this issue?

What can an attacker do after connecting?

How can I check whether a deployment is affected?