CVE-2026-16503: VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not publish PostgreSQL on all interfaces (0.0.0.0:5432). Reconfigure the PostgreSQL instance to bind only to localhost (127.0.0.1) or a specific required interface so it is not reachable externally.
Supabase/PostgreSQL (VPS.org one-click template) listen_addresses / bind address = 127.0.0.1 (or other specific interface) - Configuration
Change the default PostgreSQL database password from "postgres" to a strong, unique password.
PostgreSQL (VPS.org one-click template) default database password = change from "postgres" - Compensating control
Because Docker installs its own iptables rules and can bypass standard host UFW configuration, apply network filtering controls that account for Docker-managed iptables—e.g., restrict inbound access to the PostgreSQL port at the VPS/network level so 5432 is not reachable from untrusted networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16503?
CVE-2026-16503 has a risk score of 84, indicating a high severity vulnerability.
How do I fix CVE-2026-16503?
To fix CVE-2026-16503, you should change the default PostgreSQL password from 'postgres' and restrict access to the PostgreSQL instance by configuring Docker to limit published interfaces.
What are the implications of CVE-2026-16503?
The implications of CVE-2026-16503 include unauthorized access to the PostgreSQL database due to weak default credentials and broad exposure on all network interfaces.
Which systems are affected by CVE-2026-16503?
CVE-2026-16503 affects instances deployed using the VPS.org one-click Supabase template that expose the PostgreSQL service publicly.
Is CVE-2026-16503 easily exploitable?
Yes, CVE-2026-16503 is easily exploitable due to the default database password and the lack of access restrictions, allowing attackers to gain unauthorized access.