{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/243636#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nVPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures.\r\n\r\n### Description\r\nVPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time. \r\n\r\n**CVE-2026-16503** The `Supabase` template provides an instance of PostgreSQL that is bound to all network interfaces `(0.0.0.0:5432)` and uses the hard-coded database password `postgres`. Because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations. If the the instance is exposed to the internet, a remote attacker could connect to the host's published `TCP port 5432` and authenticate as the `postgres` superuser account using the default `postgres` password.\r\n\r\n**CVE-2026-16504** The `Zulip` template ships with a hard-coded application key `secret_key: changeme`, a default database password `zulip`, and the setting `DISABLE_HTTPS=True`. An attacker can use this public secret key to forge or validate signed session material, enabling session forgery and authentication bypass against the instance. If unchanged, the default database password `zulip` can be used to authenticate to the database. Furthermore, the `DISABLE_HTTPS=True` configuration causes all traffic to be sent over unencrypted HTTP by default, exposing credentials and session data to potential interception in certain deployments.\r\n\r\n### Impact\r\nCVE-2026-16503 (Supabase template): PostgreSQL superuser access from the internet enables the following:\r\n* read and exfiltrate data\r\n* insert/modify/delete data\r\n* alter the database schema, roles, and privileges\r\n* establish persistence via database objects \r\n* denial of service through destructive statements (dropping tables/databases)\r\n\r\nCVE-2026-16504 (Zulip template): Authentication bypass and session forgery allows the following: \r\n* account and instance takeover\r\n* interception of credentials and session tokens over unencrypted transport\r\n\r\nThis constitutes a *Technical Impact = Total* under the [SSVC](https://certcc.github.io/SSVC/reference/decision_points/technical_impact/) framework, meaning:\r\n> The vulnerability gives the adversary total control over the behavior of the software or total disclosure of all information on the affected system.\r\n\r\n### Solution\r\nUnfortunately, VPS.org could not be reached to coordinate these vulnerabilities, and a patch is not yet available. Users of VPS.org one-click deployment templates are advised to change any default passwords and secret keys before deploying to a production environment. Firewall rules and network segmentation should be implemented to restrict internet access to back-end systems such as databases and other sensitive resources. Finally, where applicable, HTTPS should be enabled to protect credentials and session data in transit. \r\n\r\n### Acknowledgements\r\nThank you to Simon Gajdosik for reporting these vulnerabilities. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/243636"},{"url":"https://www.vps.org/","summary":"https://www.vps.org/"}],"title":"VPS.org one-click deployment templates contain multiple vulnerabilities","tracking":{"current_release_date":"2026-07-31T15:20:13+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.43"}},"id":"VU#243636","initial_release_date":"2026-07-31 15:15:50.332087+00:00","revision_history":[{"date":"2026-07-31T15:20:13+00:00","number":"1.20260731152013.2","summary":"Released on 2026-07-31T15:20:13+00:00"}],"status":"final","version":"1.20260731152013.2"}},"vulnerabilities":[{"title":"Deployment of the VPS.","notes":[{"category":"summary","text":"Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}],"cve":"CVE-2026-16504","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#243636"}]},{"title":"Deployment of the VPS.","notes":[{"category":"summary","text":"Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to \"postgres\". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration."}],"cve":"CVE-2026-16503","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#243636"}]}],"product_tree":{"branches":[]}}