Description
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VPS.org | Zulip template | N/A | — |
Critical · 9.8
CVE-2026-16504
EUVD-2026-51548GHSA-8h3p-4mcm-phwx
VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Published Jul 31, 2026 · Updated Aug 3, 2026 · Assigned by certcc