BlueprintUE Self-Hosted Edition: Resource exhaustion via anonymous blueprints

Summary

BlueprintUE Self-Hosted Edition from version 1.0.0 before 4.3.5 allows unauthenticated attackers to repeatedly create anonymous blueprints with a 'never' expiration. Large requests bypass the purge routines and can fill the server storage. This results in a denial of service for the application and possibly other services on the same host.

Affected

• BlueprintUE Self-Hosted Edition 1.0.0 up to but not including 4.3.5

Fixed in

• Version 4.3.5 (fix commit 0709b39851bf58febccf0bc74b88fa86070410de, PR #268)

Workaround

• Unknown. No vendor-documented workaround found.
• Analyst measures, not vendor-sourced: apply rate limiting to the creation endpoint at a reverse proxy or WAF, and set disk quotas on the storage volume.

Exploitation

• Not known to be exploited as of 11 Nov 2026.
• No public proof-of-concept found in the searches performed, but the public fix diff makes the flaw easy to understand.

Our recommendation

• Identify all BlueprintUE Self-Hosted Edition instances and their versions.
• Upgrade every instance below 4.3.5 and verify that the anonymous creation limits are active.
• Until the upgrade is done, restrict internet exposure and monitor free disk space and fast growth of the storage volume.
• Check that the purge jobs do not hide the problem, because 'never' expiration blueprints are not purged.
• Confirm the fix against the vendor advisory GHSA-q2vm-p36g-w596 once its text is available.
• Use the 4.3.5 upgrade as well to cover related fixes CVE-2026-122139 and CVE-2026-122138 (verify against release notes).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-126659 www.cve.org
• Fix commit 0709b39 github.com
• Pull request #268 github.com
• Release v4.3.5 github.com
• GitHub Security Advisory GHSA-q2vm-p36g-w596 github.com
• VulnCheck advisory www.vulncheck.com
• OffSeq threat radar radar.offseq.com
• Vulnerable code HomeController.php at v4.3.4 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:22.