What is the CVSS score of CVE-2026-16504?

CVE-2026-16504 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Zulip Template are affected by CVE-2026-16504?

Organizations using VPS.org's one-click Zulip deployment face an immediate credential exposure affecting all instances, with no vendor patch available.

How to fix or mitigate CVE-2026-16504?

Within 24 hours, identify all Zulip instances deployed via the VPS.org one-click template and evaluate risk posture-prioritize taking critical instances offline or isolating them from production if remediation cannot be completed immediately. Within 7 days, for each affected instance: rotate the hardcoded application signing key, change the default database password from 'zulip' to a strong unique credential, and enable HTTPS by setting DISABLE_HTTPS=False. Within 30 days, audit database access logs for unauthorized queries, review authentication logs for evidence of forged sessions, and develop a plan to migrate affected instances to vendor-supported or securely hardened deployment options.

Zulip Template CVE-2026-16504

EUVD-2026-51548 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-31 certcc

GHSA-8h3p-4mcm-phwx

Information Disclosure Zulip Template

9.8

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Static signing key is effectively public, so an unauthenticated remote attacker can forge sessions with no target-specific effort (AV:N/AC:L/PR:N), yielding full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 20:36 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 31, 2026 - 15:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 15:19 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.

AnalysisAI

Credential and cryptographic-key exposure in the VPS.org one-click Zulip deployment template ships every instance with an identical hardcoded application signing key, a default database password of "zulip", and HTTPS disabled (DISABLE_HTTPS=True), allowing remote attackers who know the public template defaults to forge authenticated sessions, read Zulip's database, and intercept traffic. Any organization that provisioned Zulip through this VPS.org one-click image is affected until the secrets are rotated. There is no public exploit identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), but SSVC rates technical impact as total and automatable, reflecting that the shared secrets are identical across all deployments.

Technical ContextAI

The affected component is VPS.org's one-click marketplace template for Zulip, an open-source team chat server (CPE cpe:2.3:a:vps.org:zulip_template). The root cause is CWE-321, Use of a Hard-coded Cryptographic Key: Zulip derives session cookies, CSRF tokens, and other signed values from a SECRET_KEY/application signing key that is supposed to be uniquely generated per install. Because the template bakes in a static key, that key is common to every instance provisioned from the image and effectively public, so signatures produced by any deployment can be validated (and forged) against any other. The problem is compounded by two additional weaknesses in the same template: a well-known default PostgreSQL password ("zulip") for the Zulip application database, and DISABLE_HTTPS=True, which serves the application over plaintext HTTP and removes transport encryption for credentials and session cookies.

RemediationAI

No vendor-released patch version is identified at time of analysis, and the affected versions are listed only as N/A, so remediation is operational rather than a simple upgrade. Immediately regenerate Zulip's application signing/SECRET_KEY so forged sessions are invalidated (this will log out existing sessions), change the PostgreSQL database password from the default "zulip" to a strong unique value and update Zulip's configuration accordingly, and set DISABLE_HTTPS=False (or otherwise terminate TLS in front of the server) and install a valid certificate so credentials and cookies are no longer sent in plaintext - note that enabling HTTPS may require updating EXTERNAL_HOST and reverse-proxy/redirect settings. As compensating controls until secrets are rotated, restrict the PostgreSQL port (5432) to localhost/trusted hosts via firewall so the default password cannot be used remotely, and place the instance behind a TLS-terminating reverse proxy or VPN to mitigate the disabled-HTTPS exposure. Consult the CERT/CC note at https://kb.cert.org/vuls/id/243636 for authoritative guidance, and consider redeploying from a corrected template if VPS.org publishes one.