CVE-2026-126812

validating

GHSA-2qmp-cjw7-vvxj ↗

no check availablenot proven exploitable

cve.orgpublic pockev

blueprintue blueprintue-self-hosted-edition >= 1.0.0, < 4.3.7

fixed in 4.3.7

CWE-258 Empty Password in Configuration File

ETK-2026-4220, permanent identifier

cvss9.3cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

–running

startingcurrent stage

timeline

0 = trigger signal

trigger signal (cve.org) +0h

+2h

+4h

+6h

+8h

+10h

+12h

description

blueprintUE Self-Hosted Edition releases before 4.3.7 can deploy MariaDB with passwordless root access and a publicly reachable database port. An unauthenticated attacker able to connect to port 3306 on the Docker host can access, change, or remove stored accounts, blueprints, and other database contents.

Still under analysis: more detail becomes available as the pipeline runs.

mitigation

Upgrade blueprintUE Self-Hosted Edition to version 4.3.7. Until upgraded, disable empty MariaDB root passwords and restrict or remove external exposure of port 3306.

fixed in 4.3.7

check

building now

exploit

not yet

automation

–

auth required

EPSS

–

agent run time

–

cve.org record, t = 0

2026-11-11 20:53Z

Δ to public poc

–

Δ to kev

–

outcome

Run in progress: no artifact yet.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-11 20:53Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-126812

this entry in the feed

GET /api/v1/feed/CVE-2026-126812

{
  "etk_id": "ETK-2026-4220",
  "cve_id": "CVE-2026-126812",
  "display_id": "CVE-2026-126812",
  "ghsa_id": "GHSA-2qmp-cjw7-vvxj",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Insecure MariaDB default configuration in blueprintUE Self-Hosted Edition",
  "summary": "blueprintUE Self-Hosted Edition releases before 4.3.7 can deploy MariaDB with passwordless root access and a publicly reachable database port. An unauthenticated attacker able to connect to port 3306 on the Docker host can access, change, or remove stored accounts, blueprints, and other database contents.",
  "mitigation": "Upgrade blueprintUE Self-Hosted Edition to version 4.3.7. Until upgraded, disable empty MariaDB root passwords and restrict or remove external exposure of port 3306.",
  "vendor": "blueprintue",
  "product": "blueprintue-self-hosted-edition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.0, < 4.3.7"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.3.7"
      ],
      "package_name": "blueprintue-self-hosted-edition",
      "purl": null
    }
  ],
  "cwes": [
    258
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-11T20:53:12.974000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T20:53:12.974000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T20:53:12.974000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126812"
    }
  }
}

published 2026-11-11 21:21Z
last change 2026-11-11 21:50Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.