CVE-2026-16504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16504", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-21T19:08:55.664Z", "datePublished": "2026-07-31T15:19:42.435Z", "dateUpdated": "2026-08-03T17:18:24.554Z"}, "containers": {"cna": {"title": "VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities", "descriptions": [{"lang": "en", "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "VPS.org", "product": "Zulip template", "versions": [{"status": "affected", "version": "N/A"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "description": "CWE-321: Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "description": "CWE-1393: Use of Default Password"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/243636"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16504"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-31T15:19:42.435Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1188", "lang": "en", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-321", "lang": "en", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-1393", "lang": "en", "description": "CWE-1393 Use of Default Password"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T17:17:56.627151Z", "id": "CVE-2026-16504", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T17:18:24.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-16504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T17:17:56.627151Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1393", "description": "CWE-1393 Use of Default Password"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T17:16:53.804Z"}}], "cna": {"title": "VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "VPS.org", "product": "Zulip template", "versions": [{"status": "affected", "version": "N/A"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/243636"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16504"}, "descriptions": [{"lang": "en", "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}, {"descriptions": [{"lang": "en", "description": "CWE-321: Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "description": "CWE-1393: Use of Default Password"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-31T15:19:42.435Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16504", "state": "PUBLISHED", "dateUpdated": "2026-08-03T17:18:24.554Z", "dateReserved": "2026-07-21T19:08:55.664Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-31T15:19:42.435Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Zulip template", "vendor": "VPS.org", "versions": [{"status": "affected", "version": "N/A"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}, {"lang": "es", "value": "El despliegue de la plantilla de Zulip de un solo clic de VPS.org despliega una clave de firma de aplicaci\u00f3n codificada de forma fija, una contrase\u00f1a de base de datos predeterminada (\u2019zulip\u2019) y DISABLE_HTTPS=True."}], "id": "CVE-2026-16504", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16504", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T17:17:56.627151Z", "version": "2.0.3"}}]}, "published": "2026-07-31T16:16:58.873", "references": [{"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/243636"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-1188"}, {"lang": "en", "value": "CWE-1393"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Zulip template", "source": "cna", "vendor": "VPS.org"}, "product": "zulip_template", "vendor": "vps.org"}], "created": "2026-08-02T04:15:04.186914+00:00", "updated": "2026-08-04T23:30:15.885092+00:00", "vendors": ["vps.org", "vps.org$PRODUCT$zulip_template"]}