Supabase template hard-codes postgres on 0.0.0.0:5432; Zulip ships secret_key: changeme and HTTP-only transport. CVE-2026-16503 leaves PostgreSQL bound to 0.0.0.0:5432 with password postgres; CVE-2026-16504 ships Zulip with secret_key: changeme and HTTP-only transport. CERT/CC's VU#243636 rates both as SSVC Technical Impact = Total, and VPS dot org is unreachable with no patch. CVE-2026-16503 hands remote attackers PostgreSQL superuser credentials on a database published to 0.0.0.0:5432. CVE-2026-16504 does the same trick for Zulip: secretkey: changeme, default database password zulip, and DISABLEHTTPS=True. CERT/CC's VU#243636 classifies both as Technical Impact = Total under SSVC: adversary gets total control of the affected service or total disclosure of its data. https://news.ojobit.com/story/vpsorg-one-click-templates-secret-backdoors-4dfe24
Post summary
The post highlights that Supabase and Zulip templates expose default credentials and open access, providing technical details of the vulnerabilities but lacking evidence of active exploitation or available patches.