kb.cert.org
https://kb.cert.org/vuls/id/243636 CVE-2026-16503
CRITICAL
VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Record summary
CVE-2026-16503 has a selected CVSS score of 9.1 (critical).
Description
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Supabase templateBrowse VPS.org / Supabase template | CVE List | Version range not supplied | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-16503