External risk intelligence

VPS.org Zulip Template Exposes Hardcoded Secrets and Unsecured Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16504

The vulnerability affects a Zulip deployment template which, by default, disables HTTPS and uses hardcoded credentials. As a communication and collaboration platform, Zulip is designed to be a public-facing or internet-accessible service, making these insecure default configurations highly exposed to the public internet.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the standard deployment of the Zulip communication platform, specifically concerning the "one-click" template. This template, as deployed, includes hardcoded security credentials and disables encrypted connections, creating significant security risks by default. The primary concern at this stage is to determine if our environment utilizes this specific template, as the default configuration exposes sensitive information and access.

Insecure defaults in Zulip deployment template.
Default configurations pose broad security exposure.
Confirm if this specific deployment template is in use.

Attack Path

How an attacker could exploit the issue

An attacker could leverage the insecure default settings of the VPS.org Zulip one-click template to gain unauthorized access. The template deploys with a hardcoded database password and disables HTTPS, making the deployment vulnerable to external network access. If an attacker can reach the deployment, they may be able to access and manipulate sensitive data.

Accessible over the network.
Deployed with default credentials.
Compromise of data and system integrity.

Live Threat

Current exploitation, exposure, and threat context

The VPS.org one-click Zulip template deploys with a hardcoded application signing key, a default database password, and HTTPS disabled. This could allow an unauthenticated attacker to gain unauthorized access to the Zulip service and its data when the template is deployed in a network-accessible environment.

Sensitive configuration data.
Unauthenticated network access.
Compromise of service and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The deployment of the VPS.org one-click Zulip template introduces significant security risks due to hardcoded credentials, a disabled HTTPS setting, and a hardcoded application signing key. System owners and platform teams should prioritize identifying all instances of this template across their infrastructure. The immediate practical step is to locate these deployments, assess their exposure and criticality, and then engage the appropriate application or infrastructure owners to plan for remediation based on the identified risk.

Ownership: Platform and infrastructure teams.
Verification: Confirm HTTPS and credential security.
Action: Remediate or isolate affected deployments.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VPS.org Zulip template?

The Zulip one-click template is a pre-configured automation script provided by VPS.org to quickly deploy the Zulip communication and collaboration platform. Zulip is an open-source tool used for team messaging and organization. Using this specific template automates the server setup, but in this instance, it applies insecure default settings during the installation process.

What does CVE-2026-16504 mean?

This CVE identifies a security weakness involving the use of hardcoded credentials and insecure configurations. Specifically, it involves CWE-321 (Use of Hard-coded Cryptographic Key), CWE-1188 (Insecure Default Initialization of Resource), and CWE-1393 (Insecure Default Initialization of Resource). Essentially, the software is programmed to start with predictable passwords and keys and disables HTTPS by default, which weakens the entire application's security foundation.

How can an attacker trigger this vulnerability?

An attacker can exploit this by accessing the Zulip service over the network. Because the template sets insecure defaults like a known database password and disables encrypted HTTPS connections, no complex action is required to trigger the risk. Simply reaching the service via the network is sufficient. Note that simply using Zulip does not trigger the bug; it is the specific use of this insecure VPS.org installation template that creates the state.

Is my Zulip instance at risk?

Halo Surface Signal indicates this is a high-priority concern because Zulip is typically designed to be a public-facing service. If your instance was launched using the VPS.org one-click template, it is likely internet-accessible and using those insecure default settings. You should verify your deployment source immediately to determine if these specific hardcoded configurations are present in your environment.

What should I do if I use this Zulip template?

Prioritize identifying all Zulip instances in your infrastructure to see if they were deployed using this template. Once identified, treat the system as compromised. Your first steps are to isolate the affected deployments from the network to prevent unauthorized access and then coordinate with your infrastructure team to update credentials and enable HTTPS as required for secure operation.

References

kb.cert.org/vuls/id/243636

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.