CVE-2026-16503
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Deployment of the VPS.org one-click Supabase template runs a PostgreSQL instance listening on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
Risk Assessment
An attacker from the external network can gain unauthorized access to the PostgreSQL database, potentially leading to data leakage, modification, or deletion.
Recommendation
Immediately change the default database password, configure PostgreSQL to listen only on localhost (127.0.0.1), and adjust Docker firewall rules.
Original NVD description (English source)
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.