Shadow AI-Generated Apps: Unreviewed AI app-builder deployments exposing cloud data (incl. CVE-2025-48757 Supabase missing-policy example)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5723 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Supabase REST Table Dump via select=* and Schema Enumeration (CVE-2025-48757) — Exploitation (Splunk SPL)

Splunk SPL-primary detection for external clients dumping Supabase tables through the PostgREST /rest/v1/ endpoint with select=* and the public anon key, or enumerating the PostgREST schema root and many tables, the exposure demonstrated against Lovable-generated apps (linkable.site, 303 vulnerable endpoints in 170 of 1,645 apps) with missing or incorrect Row Level Security (CVE-2025-48757, CWE-863). Part of TL-2026-5723 (shadow AI-generated apps). MITRE: T1190, T1595.002, T1213, T1530.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002, T1213, T1530
• Data sources: splunk:index=web sourcetype=access_combined, supabase_api_via_reverse_proxy_or_waf
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h uri_path="/rest/v1/*" method=GET
| where NOT (cidrmatch("10.0.0.0/8", src_ip) OR cidrmatch("172.16.0.0/12", src_ip) OR cidrmatch("192.168.0.0/16", src_ip))
| eval table=mvindex(split(replace(uri_path, "^/rest/v1/", ""), "/"), 0)
| eval table=if(len(table)>0, table, null())
| eval select_star=if(match(uri_query, "(^|&)select=([*]|%2[Aa])(&|$)"), 1, 0)
| eval schema_probe=if(match(uri_path, "^/rest/v1/?$"), 1, 0)
| eval denied=if(status IN (401,403,404), 1, 0)
| stats count AS requests sum(select_star) AS select_star_requests sum(schema_probe) AS schema_probes sum(denied) AS denied_requests dc(table) AS tables_touched values(table) AS tables min(_time) AS first_seen max(_time) AS last_seen BY src_ip, host, http_user_agent
| where (select_star_requests>=1 AND (requests>=2 OR tables_touched>=2)) OR (schema_probes>=1 AND tables_touched>=5)
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip host http_user_agent requests select_star_requests schema_probes denied_requests tables_touched tables

Microsoft KQL

AzureDiagnostics
| where TimeGenerated > ago(24h)
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog"
| where requestUri_s has "/rest/v1"
| where ipv4_is_private(clientIP_s) == false
| extend Path = tostring(split(requestUri_s, "?")[0])
| extend Table = extract(@"/rest/v1/([A-Za-z0-9_]+)", 1, Path)
| extend SelectStar = httpMethod_s == "GET" and requestUri_s matches regex @"[?&]select=([*]|%2[Aa])(&|$)"
| extend SchemaProbe = httpMethod_s == "GET" and Path matches regex @"/rest/v1/?$"
| summarize Requests=count(), SelectStarRequests=countif(SelectStar), SchemaProbes=countif(SchemaProbe), DeniedRequests=countif(httpStatus_d in (401, 403, 404)), Tables=make_set_if(Table, isnotempty(Table), 25), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by clientIP_s, host_s, userAgent_s
| extend TablesTouched = array_length(Tables)
| where (SelectStarRequests >= 1 and (Requests >= 2 or TablesTouched >= 2)) or (SchemaProbes >= 1 and TablesTouched >= 5)
| project FirstSeen, LastSeen, clientIP_s, host_s, userAgent_s, Requests, SelectStarRequests, SchemaProbes, DeniedRequests, TablesTouched, Tables

Sigma

title: Supabase REST API Table Dump via select=* From External Source
id: 3f2a9c1e-7b4d-4e6a-9d21-5c8e0a1b7f11
status: experimental
description: Detects an external client querying a Supabase PostgREST endpoint (/rest/v1/) with select=* (or select=%2A), the technique used to dump whole tables through the public anon key from Lovable-generated apps whose Row Level Security policy is missing or incorrect (CVE-2025-48757, CWE-863, TL-2026-5723). Researchers replayed captured client requests with select=* against every app in the Lovable Launched showcase (303 vulnerable endpoints across 170 of 1,645 projects).
references:
    - https://mattpalmer.io/posts/CVE-2025-48757/
    - https://mattpalmer.io/posts/statement-on-CVE-2025-48757/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48757
    - https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.reconnaissance
    - attack.t1595.002
    - attack.initial-access
    - attack.t1190
    - attack.collection
    - attack.t1213
    - attack.t1530
    - cve.2025-48757
logsource:
    category: webserver
detection:
    selection:
        cs-method: GET
        cs-uri-stem|contains: '/rest/v1/'
        cs-uri-query|contains:
            - 'select=\*'
            - 'select=%2A'
            - 'select=%2a'
        sc-status: 200
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Developers or QA testing the Supabase REST API from outside the corporate network
    - Authorized penetration tests and approved attack-surface scanners
    - Server-side jobs that legitimately call PostgREST with select=* using the service role
level: high

Known false positives:

• Developers or QA testing the Supabase REST API from outside the corporate network with select=*
• Authorized penetration tests and approved attack-surface scanners probing /rest/v1/
• Admin dashboards or internal tools that legitimately call PostgREST with select=* from remote staff egress IPs

Tuning notes: Requires Supabase API traffic to pass through a reverse proxy, WAF or Application Gateway you log (supabase.co hosted endpoints are not visible in your own logs unless fronted by a custom domain; otherwise use Supabase API logs). Allowlist developer egress IPs and scanner ranges, raise the requests/tables_touched thresholds for noisy dev environments, and add your Supabase custom domains to scope. select=* is the known PoC pattern; also review wide column lists such as select=id,email,password. A schema-root hit (GET /rest/v1/ returns the table list) followed by 5+ tables is the second trigger.

• 🔒 Supabase REST Table Dump via select=* and Schema Enumeration (CVE-2025-48757) — Exploitation (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 Anonymous Supabase Writes, Deletes and Credential-Bearing Reads — Post-Exploitation (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 AI App Builder Cloud Identity Discovering, Reading or Changing Cloud Data and IAM — Cloud Identity Reach (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 Supabase REST Table Dump via select=* and Schema Enumeration (CVE-2025-48757) — Exploitation (Sigma) · unlock with TL Creds
• 🔒 Anonymous Supabase Writes, Deletes and Credential-Bearing Reads — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 AI App Builder Cloud Identity Discovering, Reading or Changing Cloud Data and IAM — Cloud Identity Reach (Sigma) · unlock with TL Creds
• 🔒 Anonymous Supabase Writes, Deletes and Credential-Bearing Reads — Post-Exploitation (Splunk SPL) · unlock with TL Creds
• 🔒 AI App Builder Cloud Identity Discovering, Reading or Changing Cloud Data and IAM — Cloud Identity Reach (Splunk SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5723.

Sample indicators (1 of 11)

• Domain: linkable[.]site

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

This is an exposure and shadow-IT awareness item, not a confirmed malware or threat-actor campaign. Orca Security's blog (2026-11-10) argues that non-engineering staff now ship apps built with AI app builders (Lovable, v0, Bolt, Replit, Base44, with hosting on Vercel or Netlify and Supabase as the data layer) that never pass through pull requests, AppSec or CNAPP review. The article says secure web gateways, CASBs, SSPM, AppSec and CNAPP tooling miss these apps. It also cites Orca Research Pod figures: 51% of organizations have adopted AI to build software, and 81% have critical vulnerabilities in AI packages (attributed to Hacker Valley News, 2026). Both figures are vendor-reported and not independently corroborated.

The concrete technical example is CVE-2025-48757. The CVE record describes an insufficient Row-Level Security (RLS) policy in Lovable through 2025-04-15 that lets remote unauthenticated attackers read or write arbitrary database tables of generated sites (CWE-863). The supplier disputes the CVE and says each customer is responsible for protecting its application's data. Researcher Matt Palmer's write-up gives the mechanics. Generated client apps talk to Supabase directly using the public anon key, so any table lacking a correct RLS policy can be queried by anyone. Palmer inspected network requests from a vulnerable site and changed the Supabase REST query to select=*. He then scripted the same modified queries against the homepages of every site in the Lovable Launched showcase. Of 1,645 apps analyzed, 170 projects (about 10.3%) had 303 vulnerable endpoints. Exposed data included user records, subscriptions, payment details and API keys (for example Google Maps and Gemini tokens). On the demonstration site Linkable, about 500 users' data was extracted and a record with a forged paid status was inserted, which shows write access. The authors also say Lovable's security scanner only checks that an RLS policy exists, not that it is correct. A public gist and a post by a Palantir engineer on 2025-04-14 showed the issue was being exploited or demonstrated publicly. The source article calls these 'production apps'. Palmer's analysis sampled a public showcase, and the production status is not established there.

Scoring is inconsistent across aggregators. cvefeed lists CVSS 3.1 9.3 with CWE-863, the NVD-style record is 'Deferred', and other vendor pages quote 9.8 and 8.26. No vector is published by the CNA, so no score is recorded here. Severity is a conservative analyst assignment. Orca states no IOCs, malware, threat actors or exploitation campaign. No network C2 indicators exist, so no BeaconBeagle correlation was applicable. The IOC list below holds exposure fingerprints and platform artifacts for hunting, not malicious infrastructure.

Detection value comes from the fingerprints Orca describes. DNS records pointing into a builder's or host's infrastructure, plus vendor domain-verification records. Response headers showing a site loads inside a builder's live editor. Builder-specific packages and file markers on VMs and container images, since production builds often strip dependency manifests. Commits under the builder's bot identity, which persists through later human edits. Cloud IAM users or roles the builder authenticates as, with trust and permissions policies whose Resource element names reachable buckets, datasets or query workgroups. Orca matches what a record points to rather than its name. On the Supabase side, projects with RLS turned off or with weak policies should be flagged.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Credential Access

T1552 Unsecured Credentials

Impact

T1565.001 Stored Data Manipulation

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• No vendor patch: the supplier disputes CVE-2025-48757 and states customers are responsible for their application's data. Lovable reported a security scan feature in Lovable 2.0 (2025-04-24), which researchers say only checks that a policy exists

Immediate actions

• Inventory AI app-builder footprint (Lovable, v0, Bolt, Replit, Base44) via DNS records, builder bot commit identities, builder-specific packages and builder-assumed cloud IAM roles
• Enable and audit Row Level Security on every Supabase table and test that policies are correct, not merely present
• Rotate API keys and secrets stored in tables or client code of any app found exposed

Workarounds

• Restrict anon-key access with correct per-table RLS policies and avoid exposing sensitive tables to the public anon role
• Remove or restrict unapproved builder IAM roles and trust policies

Longer-term hardening

• Define which AI app builders are approved and route AI-built apps through code review and CNAPP/AppSec scanning
• Prioritize AI-built apps by what they can reach, especially cloud identities with access to sensitive data
• Connect DNS providers to the asset inventory so DNS fingerprints cover all zones

Affected and fixed versions

• Lovable — Lovable AI app builder (generated apps using Supabase)
  Vulnerable versions: through 2025-04-15
• Supabase — Supabase projects without correct Row Level Security policies
  Vulnerable versions: projects with RLS missing or misconfigured

Timeline

• 2025-03-20 Researchers find unauthenticated access to the users table on Linkable (locked-ioc-2), a Lovable-built site backed by Supabase
• 2025-03-21 Broader scan run across Lovable-built sites and initial notice emailed to Lovable
• 2025-03-24 Lovable confirms receipt of the report
• 2025-04-14 A Palantir engineer publicly posts about the same issue; researchers re-notify Lovable and start a 45-day disclosure window
• 2025-04-24 Lovable 2.0 launches with a security scan feature that researchers say checks only for RLS policy presence
• 2025-05-24 Follow-up test of Linkable finds unauthenticated write access still possible
• 2025-05-29 Matt Palmer publishes disclosure: 303 endpoints across 170 of 1,645 analyzed projects (about 10.3%) exposed
• 2025-05-30 CVE-2025-48757 published (CWE-863); supplier disputes it, citing customer responsibility for application data
• 2026-11-10 Orca Security publishes shadow AI-generated apps article citing CVE-2025-48757 and describing cloud and code fingerprints to find AI-builder apps

Sources cited

• CVE-2025-48757 detail (cvefeed) cvefeed.io · Advisory · 2025-05-30
• NVD CVE-2025-48757 NVD (NIST) · Advisory · 2025-05-30
• Statement on CVE-2025-48757 (Matt Palmer) mattpalmer.io · Research · 2025-05-29
• CVE-2025-48757 write-up (Matt Palmer) mattpalmer.io · Research · 2025-05-29
• Lovable changelog docs.lovable.dev · Vendor report · 2025-04-24
• Public gist referenced by CVE record (lhchavez) GitHub · Proof of concept
• Shadow AI Generated Apps: Find Them in the Cloud and Code You Already Scan orca.security · Blog · 2026-11-10
• Lovable Vulnerability Explained: How 170+ Apps Were Exposed (Superblocks) superblocks.com · Blog

More in vulnerability

• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches

Previous and next in vulnerability

• Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Unauthenticated Remote Code Execution (CVE-2026-126170, CVE-2026-126261, CVE-2026-126262, CVE-2026-126260) and Critical FortiOS Flaws Previous report
• Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit Next report