Skip to content
CVE-2026-126659: BlueprintUE Self-Hosted Edition Vulnerability

CVE-2026-126659: BlueprintUE Self-Hosted Edition Vulnerability

First seen 12 Nov 2026, 01:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 01:43 UTC
  • •CVE-2026-126659 affects BlueprintUE versions 1.0.0 to 4.3.4.
  • •The vulnerability allows unauthenticated attackers to exhaust server storage.
  • •No confirmed exploitation in the wild has been reported yet.

A resource exhaustion vulnerability has been identified in BlueprintUE Self-Hosted Edition versions 1.0.0 to 4.3.4. This flaw allows unauthenticated attackers to fill server storage by creating anonymous blueprints, potentially leading to denial of service. Attackers can exploit this by sending large requests to the HomeController::doProcessCreateBlueprint() function with a 'never' expiration, bypassing purges. The vulnerability is classified as CVE-2026-126659, with a CVSS score of 8.7, indicating a high severity risk. Systems that are internet-accessible and allow anonymous blueprint creation are particularly vulnerable. The urgency of exploitation in the wild is currently unknown, and no proof-of-concept code has been reported. Administrators are advised to monitor for unusual spikes in blueprint creation requests and to apply mitigation strategies until a patch is implemented.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 11h ago How this analysis works

Timeline

2026-11-11
CVE-2026-126659 published
The vulnerability was published with a CVSS score of 8.7, indicating high severity.
Redpacketsecurity
2026-11-12
Advisories published
Multiple advisories were released detailing the storage exhaustion vulnerability in BlueprintUE.
www.vulncheck.com

More articles in this cluster (5)

Following this threat?

Track CVE-2026-126659 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

What versions of BlueprintUE are affected?
BlueprintUE Self-Hosted Edition versions 1.0.0 to 4.3.4 are affected by this vulnerability.
Is there a patch available?
A patch has not been mentioned in the articles, but upgrading to version 4.3.5 or later is recommended.
What mitigation strategies should be implemented?
Until a patch is applied, restrict anonymous blueprint creation and monitor for unusual request patterns.