SECURITYCRITICALCVE-2026-126812

CVE-2026-126812: blueprintUE Docker Compose Examples Expose MariaDB With Empty Root Password (CVSS 9.8)

blueprintUE Self-Hosted before 4.3.7 ships Docker Compose examples with MYSQL_ALLOW_EMPTY_PASSWORD=yes and MariaDB published on port 3306. CVSS 9.8.

Dylan H.

Security Team

November 12, 2026
2 min read
CVE-2026-126812: blueprintUE Docker Compose Examples Expose MariaDB With Empty Root Password (CVSS 9.8)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • blueprintUE Self-Hosted Edition before 4.3.7

Summary

CVE-2026-126812 is an insecure default configuration in the Docker Compose examples of blueprintUE Self-Hosted Edition before 4.3.7. NVD lists a CVSS score of 9.8.

Details

The example database.env sets MYSQL_ALLOW_EMPTY_PASSWORD=yes, and the example Compose file publishes MariaDB on port 3306. An unauthenticated attacker who can reach the Docker host on that port can log in as root without a password, gaining full control of the database.

ItemDetail
CVECVE-2026-126812
AffectedblueprintUE Self-Hosted Edition before 4.3.7
CauseEmpty root password plus MariaDB published on 3306
Auth requiredNone
CVSS9.8

Mitigation

  1. Upgrade to blueprintUE 4.3.7 or later.
  2. If you copied the example Compose files, set a strong root password, remove MYSQL_ALLOW_EMPTY_PASSWORD, and stop publishing 3306 to the host (let the app reach the database over the internal Docker network).
  3. Block 3306 at the host firewall and verify with an external port scan. Docker-published ports bypass many host firewall rules, so check the DOCKER-USER chain too.
  4. If the database was ever reachable, assume compromise: review users, dump contents and stored credentials, and rotate secrets.

References