Default Configuration Flaw in blueprintUE Self-Hosted Edition Exposing Database Access

CVE-2026-126812

What is CVE-2026-126812?

The blueprintUE Self-Hosted Edition prior to version 4.3.7 features an insecure default configuration within its Docker Compose examples. Specifically, the 'database.env' file permits an empty password for the MySQL root user by setting MYSQL_ALLOW_EMPTY_PASSWORD=yes. This configuration exposes the MariaDB instance on port 3306, allowing unauthenticated users to gain root access. Attackers accessing the Docker host through this port can potentially read, modify, or delete database contents, user accounts, and blueprints, leading to significant data breaches if left unaddressed.

References