Executive brief
The VPS.org one-click deployment template for Zulip, a popular team collaboration and chat platform, contains multiple security flaws including hardcoded passwords and encryption disabled by default. An attacker could use these weaknesses to gain full control over the chat instance, steal sensitive communications, or impersonate users. Because the vendor has not yet provided a fix, organizations using this template must manually update their security settings and passwords to protect their data.
Technical details
The Zulip one-click deployment template from VPS.org suffers from multiple insecure defaults due to static template instantiation without per-deployment randomization. Specifically, it uses a hardcoded 'secret_key' (changeme), a default database password (zulip), and sets 'DISABLE_HTTPS=True'. A remote attacker can leverage the hardcoded secret key to forge or validate signed session material, leading to authentication bypass and full instance takeover. Additionally, the lack of HTTPS transport encryption allows for the interception of credentials and session tokens. As of the advisory date, the vendor has not responded, and no patch is available; users must manually rotate secrets and enable TLS.
Affected products
- VPS.org Zulip template All versions
Timeline
- 2026-06-05: other: Vendor notified
- 2026-07-31: disclosed: Vulnerability disclosed by CERT/CC
- 2026-07-31: advisory: NVD published CVE-2026-16504