CVE-2026-16503 describes a vulnerability in the VPS.org Supabase template where the PostgreSQL service is bound to all interfaces (0.0.0.0) with a default password, and Docker's network rules circumvent host firewall configurations. This results in the database being exposed externally despite standard firewall settings, increasing the risk of unauthorized access. The vulnerability relates to CWE-1327 (Binding to an Unrestricted IP Address), CWE-1393, and CWE-1188, indicating issues with network binding and authentication defaults. No CVSS score or vendor remediation details are currently available.

The PostgreSQL instance is exposed on all network interfaces with a default password, allowing potential attackers to connect remotely. Docker's iptables configuration bypasses host firewall rules, negating protections such as UFW. This exposure can lead to unauthorized database access, data compromise, or further system exploitation if attackers leverage the default credentials.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/243636 for current remediation guidance. Until an official fix is available, users should manually restrict PostgreSQL binding to localhost or trusted interfaces, change default passwords immediately, and review Docker network and firewall configurations to prevent external exposure.