VPS.org templates ship default database passwords

VPS.org's one-click Supabase and Zulip deployment templates use hard-coded passwords and secrets, allowing remote database or account takeover.

CERT/CC disclosed two vulnerabilities in VPS.org's one-click deployment templates that provision cloud services with static, hard-coded credentials instead of generating unique secrets per deployment. The Supabase template exposes PostgreSQL on all network interfaces with the default password 'postgres', potentially bypassing host firewall rules due to Docker's own iptables management. The Zulip template ships with a publicly known application secret key ('changeme'), a default database password, and HTTPS disabled by default, enabling session forgery, authentication bypass, and cleartext credential interception.

Both issues stem from the same root design flaw: templates are instantiated directly from static configuration files without deployment-specific randomization or network hardening at provisioning time. CERT/CC rates the technical impact as Total under SSVC, since successful exploitation can grant full database or application control, including data exfiltration, schema modification, persistence, and account takeover.

VPS.org could not be reached to coordinate disclosure and no patch is currently available. Users deploying these templates are urged to immediately change default passwords and secret keys, restrict network exposure of backend services via firewall/segmentation, and enable HTTPS before any production use.

Source reporting: https://kb.cert.org/vuls/id/243636