CVE-2026-16503

Received Received - Intake

PostgreSQL Default Credentials Exposure via VPS.org Supabase Template

Publication date: 2026-07-31

Last updated on: 2026-08-03

Assigner: CERT/CC

Description

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-08-03

Generated

2026-08-21

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-19

NVD

CVE-2026-16503

EUVD

EUVD-2026-51547

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1393	The product uses default passwords for potentially critical functionality.
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-1327	The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Attack-Flow Graph

Executive Summary

This vulnerability involves a VPS.org one-click Supabase template that deploys a PostgreSQL database instance. The database is exposed on all network interfaces (0.0.0.0:5432) with a default password set to 'postgres'. Docker's iptables rules override host UFW firewall settings, allowing unauthorized access to the database.

Detection Guidance

Check if PostgreSQL is listening on all interfaces (0.0.0.0:5432) by running: netstat -tulnp | grep 5432 or ss -tulnp | grep 5432. Verify if the default password 'postgres' is set by attempting to connect locally: psql -U postgres -h 127.0.0.1.

Impact Analysis

This vulnerability allows attackers to connect to the PostgreSQL database remotely due to its exposure on all interfaces. They can exploit the default password to gain unauthorized access, potentially leading to data theft, manipulation, or deletion.

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR and HIPAA, which mandate strict data protection and access controls. Unauthorized database exposure risks data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Change the default PostgreSQL password immediately using ALTER USER postgres WITH PASSWORD 'new_strong_password';. Restrict PostgreSQL to listen only on localhost by editing postgresql.conf to set listen_addresses = 'localhost'. Update firewall rules to block external access to port 5432.

Hi! I’m here to help you understand CVE-2026-16503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70