EUVD-2026-51547
GHSA-j3fc-fx73-7qv7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Known default password on a network-exposed port gives unauthenticated superuser DB access (PR:N/AC:L/AV:N), enabling read, modification, and destruction of data, so C/I/A all High.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
AnalysisAI
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target was deployed using the VPS.org one-click Supabase template with its default PostgreSQL password 'postgres' still unchanged, and that port 5432 is reachable from the attacker's network position (the template binds to 0.0.0.0, and Docker's iptables rules cause this to bypass host UFW deny rules, so a host firewall alone does not limit it). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderately conflicting and warrant nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for hosts with TCP 5432 open, finds a VPS.org Supabase deployment, and connects with psql using username 'postgres' and password 'postgres'. With superuser access they exfiltrate all application data, tamper with records, or drop tables. … |
| Remediation | No vendor-released patch identified at time of analysis, so remediation is configuration-driven and should be applied immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances running the VPS.org one-click Supabase template and immediately restrict network access to port 5432 (disconnect from internet or implement firewall denial rules). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today