Supabase One-Click Template Exposes Postgres to Web

A new CVE landed today that has nothing to do with anon keys or web configs — it's a database left wide open by default. At the same time, Cursor keeps pushing its agents toward more autonomy and fewer approval prompts. Put those two together and you get a clear lesson for anyone shipping with an AI builder: the infrastructure choices your tools make on your behalf need a second look, not just the code.

TL;DR

• CVE-2026-16503: the VPS.org one-click Supabase template exposes PostgreSQL on 0.0.0.0:5432 with the default password "postgres" — and Docker's own iptables rules bypass a standard UFW firewall.
• This is a real exposed-database bug. It is not the same thing as a Supabase anon key or Firebase web config, which are meant to be public.
• Cursor shipped an iOS app for launching always-on cloud agents, plus auto-review mode and computer use in Automations — all reducing the number of human checkpoints before an agent acts.
• More autonomous agents mean infrastructure decisions, like which deploy template gets used, are more likely to go unreviewed by a person.

The Supabase one-click template bug: CVE-2026-16503

Here's what happened. VPS.org offers a one-click template that spins up a Supabase-style stack. When it deploys PostgreSQL, it publishes the database on all network interfaces — 0.0.0.0:5432 — instead of binding it to localhost or an internal network. It also ships with a default database password: "postgres". Worse, because Docker installs its own iptables rules on the host, a standard UFW firewall configuration doesn't actually block the exposure. You can have UFW correctly configured and still have a database reachable from the open internet (NVD).

This is worth separating clearly from things we've flagged before. A Supabase anon key sitting in your frontend bundle is normal — it's public by design, and the real risk is missing Row Level Security behind it. This is different. This is the actual database engine, credentials and all, sitting open to anyone who scans for port 5432. If you used this template, or anything built from it, this is a stop-what-you're-doing issue: check the port, check the password, don't wait.

Cursor's agents are getting more autonomy, less review

Separately, Cursor rolled out a batch of changes that all point the same direction: less human-in-the-loop. The new iOS app lets you launch and remotely control always-on cloud agents from your phone. Auto-review is a new run mode built specifically to let Cursor