Software Engineering Institute

Overview

VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures.

Description

VPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time.

CVE-2026-16503 The Supabase template provides an instance of PostgreSQL that is bound to all network interfaces (0.0.0.0:5432) and uses the hard-coded database password postgres. Because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations. If the the instance is exposed to the internet, a remote attacker could connect to the host's published TCP port 5432 and authenticate as the postgres superuser account using the default postgres password.

CVE-2026-16504 The Zulip template ships with a hard-coded application key secret_key: changeme, a default database password zulip, and the setting DISABLE_HTTPS=True. An attacker can use this public secret key to forge or validate signed session material, enabling session forgery and authentication bypass against the instance. If unchanged, the default database password zulip can be used to authenticate to the database. Furthermore, the DISABLE_HTTPS=True configuration causes all traffic to be sent over unencrypted HTTP by default, exposing credentials and session data to potential interception in certain deployments.

Impact

CVE-2026-16503 (Supabase template): PostgreSQL superuser access from the internet enables the following:
* read and exfiltrate data
* insert/modify/delete data
* alter the database schema, roles, and privileges
* establish persistence via database objects
* denial of service through destructive statements (dropping tables/databases)

CVE-2026-16504 (Zulip template): Authentication bypass and session forgery allows the following:
* account and instance takeover
* interception of credentials and session tokens over unencrypted transport

This constitutes a Technical Impact = Total under the SSVC framework, meaning:

The vulnerability gives the adversary total control over the behavior of the software or total disclosure of all information on the affected system.

Solution

Unfortunately, VPS.org could not be reached to coordinate these vulnerabilities, and a patch is not yet available. Users of VPS.org one-click deployment templates are advised to change any default passwords and secret keys before deploying to a production environment. Firewall rules and network segmentation should be implemented to restrict internet access to back-end systems such as databases and other sensitive resources. Finally, where applicable, HTTPS should be enabled to protect credentials and session data in transit.

Acknowledgements

Thank you to Simon Gajdosik for reporting these vulnerabilities. This document was written by Bob Kemerer.

Vendor Information

References

• https://www.vps.org/