CVE-2026-16504

{"id": "CVE-2026-16504", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16504", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T17:17:56.627151Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "VPS.org", "product": "Zulip template", "versions": [{"status": "affected", "version": "N/A"}]}]}], "published": "2026-07-31T16:16:58.873", "references": [{"url": "https://kb.cert.org/vuls/id/243636", "source": "cret@cert.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-1188"}, {"lang": "en", "value": "CWE-1393"}]}], "descriptions": [{"lang": "en", "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."}, {"lang": "es", "value": "El despliegue de la plantilla de Zulip de un solo clic de VPS.org despliega una clave de firma de aplicaci\u00f3n codificada de forma fija, una contrase\u00f1a de base de datos predeterminada (\u2019zulip\u2019) y DISABLE_HTTPS=True."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "cret@cert.org"}