VPS.org One-Click Template: Public PostgreSQL Fixed Password and Zulip Session Forgery

VPS.org One-Click Template: Public PostgreSQL Fixed Password and Zulip Session Forgery 1. Basic Information Article Title : JVNVU#91736352 Multiple Vulnerabilities in VPS.org One-Click Deployment Templates Published By : JVN Publication Date : August 3, 2026 (CERT/CC primary info on July 31, 2026) Severity : High Original Source : https://jvn.jp/vu/JVNVU91736352/index.html Primary Source : https://kb.cert.org/vuls/id/243636 Related Entities : VPS.org, Supabase template, Zulip template, PostgreSQL, CVE-2026-16503, CVE-2026-16504 Patch Status : No vendor contact was established, and no patches are available as of publication. 2. Executive Summary One-click templates fail to generate deployment-specific secrets. They expose the Supabase database at 0.0.0.0:5432/postgres:postgres , and deploy Zulip with secret_key: changeme , a DB password of zulip , and plain HTTP. This allows remote takeover immediately after deployment. 3. Attack Flow Supabase/PostgreSQL A user deploys the VPS.org Supabase template using one-click deployment. PostgreSQL binds to all interfaces ( 0.0.0.0:5432 ) and uses the hardcoded superuser password postgres . Docker-specific iptables rules may bypass the host UFW settings and expose the service to the Internet. An attacker scans port 5432 and authenticates using postgres/postgres . The attacker performs data reading/exfiltration, modification/deletion, schema/role changes, establishes DB object persistence, or causes a Denial of Service (DoS) via a drop command. Zulip The template is deployed with secret_key: changeme , a DB password of zulip , and DISABLE_HTTPS=True . An attacker forges and validates signed session material using the known secret, achieving authentication bypass and account/instance takeover. The attacker connects to the database using the default password or intercepts credentials and sessions via plain HTTP paths. 4. Attacker Position and Execution Location Remote connection from the Internet to port 5432 or Zulip HTTP on the p