CVE Alert: CVE-2026-126659 – blueprintue – blueprintue-self-hosted

BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a ‘never’ expiration, bypassing purges to fill the disk and deny service.

**Risk verdict:** This is a high-priority availability risk because it can be triggered remotely without authentication; KEV and SSVC exploitation status are not provided, so confirmed in-the-wild urgency is unknown.

**Why this matters:** Successful abuse could consume storage until the application or its host becomes unavailable, disrupting users and potentially other services sharing the same storage. The likely goal is service disruption rather than data theft or modification; repeated or sustained attempts could prolong recovery and increase operational costs.

**Most likely attack path:** An attacker sends repeated requests to the public blueprint-creation function, with no account, user action or unusual conditions required. The impact appears confined to the vulnerable service’s security scope, but shared disks or hosts could widen the operational outage.

**Who is most exposed:** Internet-accessible self-hosted deployments that permit anonymous blueprint creation are most exposed, particularly where storage is shared or has no capacity safeguards.

Alert on unusual spikes in anonymous blueprint-creation requests, especially from one source or many rotating sources.

Track disk and inode consumption, growth rate, and storage remaining on the application host.

Review for persistent, non-expiring anonymous records and correlate creation times with traffic surges.

Check for elevated application errors or service degradation alongside storage growth.

Mitigation and prioritisation:

Upgrade to the vendor’s fixed release; confirm the deployed build and verify the remediation after rollout.

Until patched, restrict anonymous creation at the application or reverse-proxy layer, or temporarily disable it.

Apply request-rate and payload-size limits; enforce storage quotas and lifecycle cleanup.

No EPSS, PoC or exploitation-status data was supplied; obtain these before assigning an exploitation-led priority.

Schedule deployment with rollback and capacity monitoring, but avoid delaying remediation on exposed instances.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.