# VPS.org templates ship default database passwords

Published: 2026-07-31 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/4c01e26c-95b3-507f-aca9-635c6cd5d8b0/vps-org-templates-ship-default-database-passwords

> VPS.org's one-click Supabase and Zulip deployment templates use hard-coded passwords and secrets, allowing remote database or account takeover.

CERT/CC disclosed two vulnerabilities in VPS.org's one-click deployment templates that provision cloud services with static, hard-coded credentials instead of generating unique secrets per deployment. The Supabase template exposes PostgreSQL on all network interfaces with the default password 'postgres', potentially bypassing host firewall rules due to Docker's own iptables management. The Zulip template ships with a publicly known application secret key ('changeme'), a default database password, and HTTPS disabled by default, enabling session forgery, authentication bypass, and cleartext credential interception.

Both issues stem from the same root design flaw: templates are instantiated directly from static configuration files without deployment-specific randomization or network hardening at provisioning time. CERT/CC rates the technical impact as Total under SSVC, since successful exploitation can grant full database or application control, including data exfiltration, schema modification, persistence, and account takeover.

VPS.org could not be reached to coordinate disclosure and no patch is currently available. Users deploying these templates are urged to immediately change default passwords and secret keys, restrict network exposure of backend services via firewall/segmentation, and enable HTTPS before any production use.

## Mentioned in this report

- Vulnerabilities: CVE-2026-16503, CVE-2026-16504

Source reporting: https://kb.cert.org/vuls/id/243636

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4c01e26c-95b3-507f-aca9-635c6cd5d8b0/vps-org-templates-ship-default-database-passwords.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup