CVE-2026-16503

Name of the Vulnerable Software and Affected Versions VPS.org one-click Supabase template (affected versions not specified)

Description Deployment of the template installs a PostgreSQL instance published on all interfaces (0.0.0.0:5432) using a default database password set to postgres. This exposure bypasses standard host UFW (Uncomplicated Firewall) configurations because Docker implements its own iptables rules, which take precedence over UFW.

Recommendations Change the default database password from postgres to a strong, unique password. Restrict the PostgreSQL instance to listen only on local interfaces instead of 0.0.0.0:5432.