CVE-2026-126812

waiting for further signals

GHSA-2qmp-cjw7-vvxj ↗EUVD-2026-124027 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

blueprintue blueprintue-self-hosted-edition <=4.3.6

fixed in 4.3.7

CWE-258 Empty Password in Configuration File

ETK-2026-4220, permanent identifier

cvss9.3cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

1h 49msince last run

49mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+1h17m

+2h

+4h

+6h

+8h

+10h

+12h

description

blueprintUE Self-Hosted Edition before 4.3.7 can deploy MariaDB with an empty root password and expose it on port 3306. An unauthenticated attacker who can reach that port can access and alter database contents, including user accounts and blueprints.

mitigation

Upgrade blueprintUE Self-Hosted Edition to version 4.3.7 or later. Restrict access to MariaDB port 3306 and disable empty-password database authentication.

fixed in 4.3.7

check

exploit

automation

–

auth required

EPSS

–

agent run time

49m

cve.org record, t = 0

2026-11-11 20:53Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-11 20:53Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-126812

this entry in the feed

GET /api/v1/feed/CVE-2026-126812

{
  "etk_id": "ETK-2026-4220",
  "cve_id": "CVE-2026-126812",
  "display_id": "CVE-2026-126812",
  "ghsa_id": "GHSA-2qmp-cjw7-vvxj",
  "euvd_id": "EUVD-2026-124027",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Passwordless database access in blueprintUE Self-Hosted Edition",
  "summary": "blueprintUE Self-Hosted Edition before 4.3.7 can deploy MariaDB with an empty root password and expose it on port 3306. An unauthenticated attacker who can reach that port can access and alter database contents, including user accounts and blueprints.",
  "mitigation": "Upgrade blueprintUE Self-Hosted Edition to version 4.3.7 or later. Restrict access to MariaDB port 3306 and disable empty-password database authentication.",
  "vendor": "blueprintue",
  "product": "blueprintue-self-hosted-edition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=4.3.6"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.3.7"
      ],
      "package_name": "blueprintue-self-hosted-edition",
      "purl": null
    }
  ],
  "cwes": [
    258
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 48.79615496666667,
  "t0_at": "2026-11-11T20:53:12.974000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T20:53:12.974000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T20:53:12.974000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126812"
    }
  }
}

published 2026-11-11 21:21Z
last change 2026-11-11 23:38Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.