CVE-2026-126812

Name of the Vulnerable Software and Affected Versions blueprintUE Self-Hosted Edition versions prior to 4.3.7

Description An insecure default configuration in Docker Compose examples allows unauthenticated remote attackers to access the MariaDB database. The issue occurs because the MYSQL ALLOW EMPTY PASSWORD variable is set to yes in the database.env file and the database is published on port 3306. This allows an attacker to log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.

Recommendations Update blueprintUE Self-Hosted Edition to version 4.3.7.