GCVE-110-CERTCC-2026-243636

### Overview VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures. ### Description VPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time. **CVE-2026-16503** The `Supabase` template provides an instance of PostgreSQL that is bound to all network interfaces `(0.0.0.0:5432)` and uses the hard-coded database password `postgres`. Because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations. If the the instance is exposed to the internet, a remote attacker could connect to the host's published `TCP port 5432` and authenticate as the `postgres` superuser account using the default `postgres` password. **CVE-2026-16504** The `Zulip` template ships with a hard-coded application key `secret_key: changeme`, a default database password `zulip`, and the setting `DISABLE_HTTPS=True`. An attacker can use this public secret key to forge or validate signed session material, enabling session forgery and authentication bypass against the instance. If unchanged, the default database password `zulip` can be used to authenticate to the database. Furthermore, the `DISABLE_HTTPS=True` configuration causes all traffic to be sent over unencrypted HTTP by default, exposing credentials and session data to potential interception in certain deployments. ### Impact CVE-2026-16503 (Supabase template): PostgreSQL superuser access from the internet enables the following: * read and exfiltrate data * insert/modify/delete data * alter the database schema, roles, and privileges * establish persistence via database objects * denial of service through destructive statements (dropping tables/databases) CVE-2026-16504 (Zulip template): Authentication bypass and session forgery allows the following: * account and instance takeover * interception of credentials and session tokens over unencrypted transport This constitutes a *Technical Impact = Total* under the [SSVC](https://certcc.github.io/SSVC/reference/decision_points/technical_impact/) framework, meaning: > The vulnerability gives the adversary total control over the behavior of the software or total disclosure of all information on the affected system. ### Solution Unfortunately, VPS.org could not be reached to coordinate these vulnerabilities, and a patch is not yet available. Users of VPS.org one-click deployment templates are advised to change any default passwords and secret keys before deploying to a production environment. Firewall rules and network segmentation should be implemented to restrict internet access to back-end systems such as databases and other sensitive resources. Finally, where applicable, HTTPS should be enabled to protect credentials and session data in transit. ### Acknowledgements Thank you to Simon Gajdosik for reporting these vulnerabilities. This document was written by Bob Kemerer.