Executive brief
The VPS.org one-click Supabase deployment template creates a database that is publicly accessible from the internet with a default password. This allows any remote attacker to gain full control over the database, including the ability to steal, modify, or delete customer data. Because of how the underlying software is configured, standard server firewalls may fail to block this unauthorized access.
Technical details
The VPS.org Supabase one-click template suffers from a hard-coded credential and insecure network binding vulnerability. The template provisions a PostgreSQL instance bound to 0.0.0.0:5432 using the default password 'postgres'. Because the deployment utilizes Docker, which manages its own iptables rules, the exposure often bypasses standard host-level UFW (Uncomplicated Firewall) configurations. A remote, unauthenticated attacker can connect to the database with superuser privileges to exfiltrate data, modify records, or perform a denial-of-service attack. As of the advisory date, no vendor patch is available; users must manually rotate passwords and restrict network bindings.
Affected products
- VPS.org Supabase template All versions
Timeline
- 2026-06-05: other: Vendor notified by CERT/CC
- 2026-07-31: disclosed: Vulnerability publicly disclosed by CERT/CC
- 2026-07-31: advisory: NVD record published