Google Cloud Looker
10 CVEs affecting Google Cloud Looker. Latest disclosed: 2026-07-24. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5166 | Medium | 6.5 | 2024-05-22 | An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model. |
CVE-2026-15810 | | 2026-07-24 | A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8… | |
CVE-2025-12742 | | 2025-11-25 | A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted… | |
CVE-2025-12741 | | 2025-11-24 | A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious comma… | |
CVE-2025-12740 | | 2025-11-24 | A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious co… | |
CVE-2025-12739 | | 2025-11-24 | An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Explo… | |
CVE-2025-12414 | | 2025-11-20 | An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted… | |
CVE-2025-12743 | | 2025-11-19 | The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal n… | |
CVE-2025-12472 | | 2025-11-19 | An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary comm… | |
CVE-2025-12155 | | 2025-11-10 | A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission… |