CISA issues alert on VPS.org one-click deployment templates vulnerabilities
VPS.org one-click deployment templates include multiple hard-coded credential and configuration issues that enable internet-facing database superuser access or session forgery and authentication bypass, resulting in total control or total disclosure of affected systems.
These vulnerabilities share a root cause in which content is directly instantiated from static templates using default passwords and static secrets, without deployment-specific randomization or interface-binding hardening at provisioning time. CVE-2026-16503 affects the Supabase template, which provisions a PostgreSQL instance bound to all network interfaces (0.0.0.0:5432) with a hard-coded database password of postgres; because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations, and if the instance is exposed to the internet, a remote attacker could connect to the host’s published TCP port 5432 and authenticate as the postgres superuser account using the default postgres password. CVE-2026-16504 affects the Zulip template, which includes a hard-coded application key secret_key: changeme, a default database password zulip, and DISABLE_HTTPS=True; an attacker can use the public secret key to forge or validate signed session material, enabling session forgery and authentication bypass, and if unchanged, the default database password zulip can authenticate to the database, while DISABLE_HTTPS=True sends traffic over unencrypted HTTP by default, exposing credentials and session data to potential interception in certain deployments.
CVE-2026-16503 (Supabase template) enables internet-accessible PostgreSQL superuser actions including read and exfiltrate data, insert/modify/delete data, alter the database schema, roles, and privileges, establish persistence via database objects, and denial of service through destructive statements such as dropping tables or databases. CVE-2026-16504 (Zulip template) enables authentication bypass and session forgery that allow account and instance takeover and interception of credentials and session tokens over unencrypted transport. Under the SSVC framework, the advisory states “Technical Impact = Total,” and that the vulnerability gives the adversary total control over software behavior or total disclosure of all information on the affected system.
No patch is available because VPS.org could not be reached to coordinate these vulnerabilities. Users of VPS.org one-click deployment templates are advised to change any default passwords and secret keys before deploying to a production environment. The guidance also states that firewall rules and network segmentation should restrict internet access to back-end systems such as databases and other sensitive resources, and that where applicable, HTTPS should be enabled to protect credentials and session data in transit.
The advisory attributes the issues to static template instantiation that uses default passwords and static secrets without deployment-specific randomization or interface-binding hardening at provisioning time, and it credits Simon Gajdosik for reporting the vulnerabilities; it states that the document was written by Bob Kemerer.