CVE-2026-16503 describes a vulnerability in the VPS.org Supabase template where the deployed PostgreSQL instance is bound to all network interfaces (0.0.0.0) on port 5432 with a default password 'postgres'. Docker's iptables configuration bypasses the host's UFW firewall, exposing the database to remote networks. This misconfiguration leads to high-impact confidentiality and integrity risks as attackers can connect remotely without proper authentication controls.

An attacker can remotely connect to the PostgreSQL database using the default credentials, bypassing host firewall rules due to Docker's iptables setup. This results in full compromise of database confidentiality and integrity, allowing unauthorized data access and modification. Availability is not directly impacted. The CVSS score of 9.1 reflects the critical severity of this remote, unauthenticated access vulnerability.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/243636 for current remediation guidance. Until a fix is available, users should change the default database password immediately and restrict network exposure by configuring PostgreSQL to bind only to trusted interfaces. Additionally, review and adjust Docker and host firewall rules to prevent unauthorized external access.