{"id":"CVE-2026-126812","aliases":["EUVD-2026-124027","GHSA-2qmp-cjw7-vvxj","GHSA-9f6r-vjc7-jq67"],"status":"published","title":"blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00604,"percentile":0.49472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-258"],"published":"2026-11-11T20:53:12Z","modified":"2026-11-13T00:05:02Z","products":[{"vendor":"blueprintue","product":"blueprintue-self-hosted-edition"}],"references":[{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-9f6r-vjc7-jq67","tags":["vendor-advisory","exploit","advisory"]},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/e6a6e1d4c2f22efbbabf9fb31ec479544405b469","tags":["patch","fix"]},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/270","tags":["issue-tracking","patch","fix"]},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.7","tags":["release-notes","advisory"]},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/database.env","tags":["technical-description","article"]},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/docker-compose-smtp.yml#L14-L24","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.7-empty-mariadb-root-password-via-docker-compose","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126812","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2qmp-cjw7-vvxj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126812.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-126812","title":"blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","status":"published","published":"2026-11-11T20:53:12.974Z","modified":"2026-11-13T00:05:02.077Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-258"],"updated_at":"2026-11-13T01:51:24.77911Z"}],"euvd":[{"id":"EUVD-2026-124027","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","status":"published","published":"2026-11-11T20:53:12Z","modified":"2026-11-13T00:05:02Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-11T23:30:57.284312Z"}],"ghsa":[{"id":"GHSA-2qmp-cjw7-vvxj","title":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its...","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","status":"published","published":"2026-11-11T21:33:01Z","modified":"2026-11-11T21:33:09Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-258"],"updated_at":"2026-11-11T21:36:29.153415Z"}],"nvd":[{"id":"CVE-2026-126812","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","status":"published","published":"2026-11-11T21:16:45.69Z","modified":"2026-11-13T02:18:52.967Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-258"],"updated_at":"2026-11-13T06:34:39.264462Z"}],"osv":[{"id":"CVE-2026-126812","title":"blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose","description":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","status":"published","published":"2026-11-11T20:53:12.974Z","modified":"2026-11-14T02:30:36.242507087Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-258"],"updated_at":"2026-11-13T02:57:32.2543Z"}]}}