Horizon Alert
Summary of the vulnerability and why it matters
This advisory highlights a critical vulnerability in the VPS.org one-click Supabase template. The template deploys a PostgreSQL instance that is accessible from all network interfaces with a default password, and a Docker configuration can bypass standard firewall rules. This could allow unauthorized access to the database.
- Default Supabase template exposes PostgreSQL publicly.
- Critical exposure could lead to unauthorized data access.
- Confirm if your Supabase template requires immediate review.
Attack Path
How an attacker could exploit the issue
An attacker can reach a vulnerable PostgreSQL database instance deployed using the VPS.org one-click Supabase template because it is published on all network interfaces with a default password. This exposure bypasses host firewall rules due to Docker's iptables configuration. The vulnerability could allow an attacker to access and modify sensitive data.
- Database exposed externally.
- Default credentials allow access.
- Unauthorized data access and modification.
Live Threat
Current exploitation, exposure, and threat context
When the VPS.org one-click Supabase template is deployed, the associated PostgreSQL database instance is exposed on all network interfaces with a default password. This configuration bypasses host firewall rules, potentially allowing unauthorized access to the database.
- Database instance and data at risk.
- Exposed by default network configuration.
- Unauthorized access to sensitive data.
Operational Fix
Recommended remediation, mitigation, and detection steps
In real-world deployments, ownership of this vulnerability likely falls to infrastructure or platform teams responsible for managing database instances and Docker environments. The immediate first step is to identify all deployed VPS.org Supabase templates, determine their network reachability and business criticality, and then locate the accountable owner to plan remediation.
- Infrastructure and platform teams own remediation.
- Verify exposed PostgreSQL instances and default passwords.
- Plan controlled restart or configuration changes.
