Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-16503: Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all i

49
This month
CRITICAL 9.1REMOTE

CVE-2026-16503 is a critical-severity flaw (CVSS 9.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.

Why this priority

  • Critical severity
  • CISA SSVC: automatable with total technical impact
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.1 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.4% (top 64%)
CISA exploited listNo
WeaknessCWE-1188, CWE-1327, CWE-1393
Published2026-07-31
Last modified2026-10-23
Publisher (CNA): CERT/CC

Last updated 2026-10-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

Exact fixes by distribution

Fedora 46 · rubygem-eventmachine · FIXED · 1.2.7-37.fc46 · FEDORA-2026-7194c202a2 · source
sudo dnf upgrade --advisory=FEDORA-2026-7194c202a2
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-16503?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-16503 being exploited?

CVE-2026-16503 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-16503 affect?

CVE-2026-16503 affects affected software. Severity is critical (CVSS 9.1). Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this

How urgent is CVE-2026-16503?

Priority 49/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Docker vulnerabilities · PostgreSQL vulnerabilities

References

← Back to latest CVEs