CVE-2026-126812: Critical blueprintUE MySQL Exposure — Immediate Detection and Remediation Guide

A critical vulnerability, CVE-2026-126812, has been published with a CVSS score of 9.8 (CRITICAL). This is not a complex memory corruption or a sophisticated zero-day; it is a catastrophic failure of secure configuration in blueprintUE Self-Hosted Edition prior to version 4.3.7.

The issue resides in the official Docker Compose examples provided by the vendor. These examples set MYSQL_ALLOW_EMPTY_PASSWORD=yes in the database.env file and, critically, publish the MariaDB service on host port 3306. The result is a network-facing database that allows unauthenticated, remote attackers to log in as the MySQL root user without any password. This grants full control over all application data, including user accounts, blueprints, and every database on the instance.

For defenders, this is a five-alarm fire. The attack vector is network-based, requires no user interaction, and no special privileges. If your blueprintUE instance is reachable on port 3306 from any untrusted network, you must assume it is fully compromised until proven otherwise.

Technical Analysis

Affected Products and Versions

• Product: blueprintUE Self-Hosted Edition
• Affected Versions: All versions before 4.3.7
• Component: Docker Compose deployment examples (specifically docker-compose.yml and database.env)
• Underlying Database: MariaDB (configured as MySQL)

Vulnerability Breakdown

The vulnerability is a direct consequence of two insecure settings in the default deployment configuration:

1. MYSQL_ALLOW_EMPTY_PASSWORD=yes: This environment variable explicitly instructs the MariaDB container to allow the root user to connect with an empty password. This is a development convenience that should never be used in any environment accessible from a network.
2. Port Publishing on 3306: The docker-compose.yml file maps the container's internal port 3306 to the host's port 3306. This makes the database service directly accessible from any network that can reach the Docker host, bypassing any application-layer authentication or authorization.

The attack chain is trivially simple:

1. An attacker scans for hosts with TCP port 3306 open.
2. Upon finding a blueprintUE instance, the attacker attempts to connect using the MySQL client with mysql -u root -h <target_ip> and no password.
3. The MariaDB server, configured to accept empty passwords, grants the attacker full root access.

From this point, the attacker can:

• Read all sensitive data (user credentials, blueprints, application secrets).
• Modify or delete all data, leading to complete data loss or ransomware-style destruction.
• Create new administrative users within the database to establish persistence.
• Potentially pivot to other internal systems if the database contains connection strings or credentials for other services.

Exploitation Status

As of this writing, the NVD entry for CVE-2026-126812 is newly published. While there is no confirmed widespread in-the-wild exploitation campaign reported yet, the barrier to exploitation is effectively zero. Public proof-of-concept code is unnecessary; any attacker with a MySQL client can exploit this. It is highly probable that automated scanners and botnets are already probing for this exposure. This vulnerability is a prime candidate for immediate inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Detection & Response

Given the nature of this vulnerability, detection efforts must focus on identifying exposed instances and monitoring for unauthorized database access.

Sigma Rules

The following Sigma rules are designed to detect reconnaissance and potential exploitation attempts against this exposure. They should be deployed on network sensors, host-based EDR on the Docker host, and within centralized logging systems.

---
title: Network Connection to Exposed MySQL Port 3306
id: 9e2b7c8a-4f5d-4a1b-9c3d-8e1f2a3b4c5d
status: experimental
description: Detects inbound network connections to TCP port 3306, which may indicate reconnaissance or exploitation of CVE-2026-126812.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126812
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.reconnaissance
  - attack.t1595.002
logsource:
  category: network_connection
  product: windows # Can be adapted for Linux/Network Sensor
detection:
  selection:
    DestinationPort: 3306
    Initiated: 'true' # Focus on inbound connections
  condition: selection
falsepositives:
  - Legitimate internal application or administrative access to the database.
  - Internal network scanners.
level: high
---
title: MySQL Client Execution with Empty Password Attempt
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of the MySQL client with command-line arguments indicative of a connection attempt using the root user and no password, a key indicator for exploiting CVE-2026-126812.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126812
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows # Can be adapted for Linux
detection:
  selection_image:
    Image|endswith: '\mysql.exe'
  selection_command:
    CommandLine|contains:
      - '-u root'
      - '-h '
  filter_empty_password:
    CommandLine|contains:
      - '-p' # Filter out connections that *do* provide a password
  condition: selection_image and selection_command and not filter_empty_password
falsepositives:
  - Legitimate administrative scripts or developers connecting to local, non-exposed instances.
level: critical

KQL (Microsoft Sentinel / Defender)

This KQL query hunts for network connections to port 3306 from external sources. It assumes network logs (e.g., from a firewall or NSG flow logs) are being ingested into the CommonSecurityLog table.

// Hunt for external network connections to TCP port 3306
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 3306
| where DeviceAction != "Allow" // Focus on denied or suspicious actions if logging is verbose
| extend SourceIPType = iff(ipv4_is_private(SourceIP), "Private", "Public")
| where SourceIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by ConnectionCount desc

Velociraptor VQL

This VQL artifact can be used to hunt for MySQL client processes on endpoints that are attempting to connect to remote hosts without a password, a strong indicator of active exploitation.

-- Hunt for MySQL client connections with empty password attempts
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'mysql'
   AND CommandLine =~ '-u root'
   AND CommandLine =~ '-h'
   AND NOT CommandLine =~ '-p'

Remediation Script (Bash)

This script is designed to be run on the Linux Docker host to immediately identify and mitigate the vulnerability.

#!/bin/bash
# CVE-2026-126812 Immediate Mitigation Script for blueprintUE
# WARNING: This script will stop the blueprintUE stack. Test in a non-production environment first if possible.

echo "[INFO] Starting CVE-2026-126812 mitigation check..."

# 1. Check if port 3306 is exposed on the Docker host
if sudo docker ps --format "table {{.Names}}\t{{.Ports}}" | grep -q "0.0.0.0:3306"; then
    echo "[CRITICAL] MySQL port 3306 is EXPOSED to the network. Immediate action required."
    
    # 2. Identify the blueprintUE project directory
    PROJECT_DIR=$(sudo docker compose ls --format json | jq -r '.[] | select(.Name | contains("blueprintue")) | .ConfigFiles' | xargs dirname 2>/dev/null | head -n 1)
    
    if [ -z "$PROJECT_DIR" ]; then
        echo "[ERROR] Could not automatically determine the blueprintUE project directory."
        echo "[ACTION REQUIRED] Please manually navigate to your blueprintUE directory and run: docker compose down"
        exit 1
    fi
    
    echo "[INFO] Found blueprintUE project directory: $PROJECT_DIR"
    cd "$PROJECT_DIR"
    
    # 3. Check for the vulnerable configuration
    if grep -q "MYSQL_ALLOW_EMPTY_PASSWORD=yes" database.env; then
        echo "[VULNERABLE] database.env contains 'MYSQL_ALLOW_EMPTY_PASSWORD=yes'."
        
        # 4. Immediate Mitigation: Stop the stack
        echo "[ACTION] Stopping the blueprintUE Docker stack to prevent further exposure..."
        sudo docker compose down
        
        echo "[SUCCESS] blueprintUE stack has been stopped."
        echo "[NEXT STEPS]"
        echo "1. Update blueprintUE to version 4.3.7 or later."
        echo "2. Edit database.env and set a strong password for MYSQL_ROOT_PASSWORD."
        echo "3. Remove or comment out 'MYSQL_ALLOW_EMPTY_PASSWORD=yes' from database.env."
        echo "4. Edit docker-compose.yml to remove the 'ports: - \"3306:3306\"' mapping for the database service."
        echo "5. Restart the stack with 'docker compose up -d'."
        
    else
        echo "[OK] database.env does not contain 'MYSQL_ALLOW_EMPTY_PASSWORD=yes'."
    fi
    
else
    echo "[OK] MySQL port 3306 does not appear to be exposed to the network on this host."
fi

echo "[INFO] Mitigation check complete."

Remediation

Immediate and comprehensive action is required to remediate CVE-2026-126812.

1. Isolate Immediately: If the blueprintUE instance is not business-critical, immediately take it offline. The fastest way to do this is to run docker compose down in the blueprintUE project directory.
2. Patch to the Latest Version: Upgrade blueprintUE Self-Hosted Edition to version 4.3.7 or later. The vendor has corrected the insecure default configuration in this release. Refer to the official blueprintUE release notes and update instructions.
3. Harden the Configuration: Even after patching, manual verification is essential.
   • Set a Strong Root Password: In your database.env file, set a strong, unique password for MYSQL_ROOT_PASSWORD.
   • Remove Empty Password Flag: Delete or comment out the line MYSQL_ALLOW_EMPTY_PASSWORD=yes from database.env.
   • Restrict Network Exposure: Edit your docker-compose.yml file. Remove the ports mapping for the database service (e.g., - "3306:3306"). The database should only be accessible to other containers within the same Docker network, not to the host or external networks. If external access is absolutely required (which is highly discouraged), place it behind a firewall with strict IP whitelisting.
4. Network-Level Controls: Implement firewall rules (e.g., iptables, nftables, or cloud security groups) to explicitly deny all inbound traffic to TCP port 3306 on the Docker host from any untrusted network.
5. Audit and Rotate: Assume the database has been compromised.
   • Audit Logs: Review database logs (if available) and host-level logs for any signs of unauthorized access or data exfiltration.
   • Rotate Credentials: Change all passwords for all user accounts within the blueprintUE application. If the database stored credentials for other services (e.g., API keys, SMTP passwords), rotate those as well.
   • Data Integrity Check: Verify the integrity of your blueprints and user data. Restore from a known-good backup if any tampering is suspected.
6. CISA KEV Monitoring: Monitor the CISA Known Exploited Vulnerabilities (KEV) catalog. If CVE-2026-126812 is added, federal agencies will have a binding remediation deadline, which is a strong indicator of active, widespread exploitation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub