CVE-2026-16503

CRITICAL

VPS.org Supabase Template - Exposed PostgreSQL with Default Password

Title source: manual

Description

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.

References (1)

Core 1

Core References

https://kb.cert.org/vuls/id/243636

Scores

CVSS v3 9.1

EPSS 0.0025

EPSS Percentile 16.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-1188 CWE-1327 CWE-1393

Status published

Products (1)

VPS.org/Supabase template

Published Jul 31, 2026

Tracked Since Jul 31, 2026