Deploying the VPS.org one‑click Supabase template creates a PostgreSQL instance that is bound to all network interfaces (0.0.0.0:5432) and is configured with the default password “postgres”. Because the database is exposed over the network and accepts the default credentials, anyone who can reach the host can connect to the database and potentially read, modify, or delete data, or use the database as a foothold for further exploitation. This is a clear example of weak credentials combined with an open service interface, leading to a direct confidentiality and integrity breach.

The vulnerability affects installations that use the VPS.org Supabase template. No specific affected version range is provided, so any instance deployed via the one‑click template is potentially impacted. The issue arises from the Docker container that applies its own iptables rules, bypassing host‑level firewall settings such as UFW, thereby widening the attack surface of the host machine.

The EPSS score is reported as less than 1 %, indicating a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is purely network‑based: the database listens on all interfaces. An attacker only needs network visibility to the host to attempt authentication with the default credential. With a CVSS score of 9.1, this weakness represents a high‑severity risk that could allow full database compromise, exposing sensitive data, and providing a foothold for further attacks. Although the EPSS remains low, the severity suggests it should be addressed promptly.