CVE-2026-16504 - Vulnerability Details - OpenCVE

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Vps.org	Zulip Template

No data.

No data.

References

Link	Providers
https://kb.cert.org/vuls/id/243636

History

Tue, 04 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-256 CWE-287 CWE-311

Mon, 03 Aug 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1188 CWE-1393 CWE-321
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sun, 02 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vps.org Vps.org zulip Template
Vendors & Products		Vps.org Vps.org zulip Template

Sun, 02 Aug 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-256 CWE-287 CWE-311

Fri, 31 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
Title		VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
References		https://kb.cert.org/vuls/id/243636

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-07-31T15:19:42.435Z

Updated: 2026-08-03T17:18:24.554Z

Reserved: 2026-07-21T19:08:55.664Z

Link: CVE-2026-16504

Vulnrichment

Updated: 2026-08-03T17:16:53.804Z

NVD

Status : Deferred

Published: 2026-07-31T16:16:58.873

Modified: 2026-09-08T14:09:10.550

Link: CVE-2026-16504

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16504", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-21T19:08:55.664Z", "datePublished": "2026-07-31T15:19:42.435Z", "dateUpdated": "2026-08-03T17:18:24.554Z"}, "containers": {"cna": {"title": "VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities", "descriptions": [{"lang": "en", "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "VPS.org", "product": "Zulip template", "versions": [{"status": "affected", "version": "N/A"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "description": "CWE-321: Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "description": "CWE-1393: Use of Default Password"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/243636"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16504"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-31T15:19:42.435Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1188", "lang": "en", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-321", "lang": "en", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-1393", "lang": "en", "description": "CWE-1393 Use of Default Password"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T17:17:56.627151Z", "id": "CVE-2026-16504", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T17:18:24.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-16504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T17:17:56.627151Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1393", "description": "CWE-1393 Use of Default Password"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T17:16:53.804Z"}}], "cna": {"title": "VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "VPS.org", "product": "Zulip template", "versions": [{"status": "affected", "version": "N/A"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/243636"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16504"}, "descriptions": [{"lang": "en", "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "description": "CWE-321: Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "description": "CWE-1393: Use of Default Password"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-31T15:19:42.435Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16504", "state": "PUBLISHED", "dateUpdated": "2026-08-03T17:18:24.554Z", "dateReserved": "2026-07-21T19:08:55.664Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-31T15:19:42.435Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}