Field brief
BlueprintUE Self‑Hosted Edition Vulnerability CVE‑2026‑126812: Critical MariaDB Default Password
A critical flaw in BlueprintUE’s Docker Compose defaults allows unauthenticated root access to MariaDB; fixed in v4.3.7.
A recent NVD entry (CVE‑2026‑126812) highlights a critical vulnerability in BlueprintUE Self‑Hosted Edition versions prior to 4.3.7. The Docker Compose examples set `MYSQL_ALLOW_EMPTY_PASSWORD=yes` in `database.env`, exposing MariaDB on port 3306 with a root account that has no password. Unauthenticated attackers who can reach the Docker host can log in as root and read, modify, or delete all databases, blueprints, and user accounts. The CVSS score is 9.8 (CRITICAL). No official vendor advisory has yet been issued, and the CISA KEV list shows no entry. The vulnerability was fixed in release 4.3.7, which removes the insecure default. Updating to 4.3.7 and reviewing Docker Compose files for any remaining default‑password settings is the recommended defensive action. See the NVD record for details: CVE‑2026‑126812.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.