Loading story…
Tenable disclosed two vulnerabilities in Google Looker (collectively dubbed “LookOut”) that can enable remote code execution (RCE) and sensitive data exposure, with heightened risk for organizations running customer-hosted/on-premises Looker. Tenable reported an RCE chain involving Git hook overrides that could allow attackers to execute arbitrary commands on the Looker host, potentially leading to full server compromise, theft of secrets, data manipulation, and lateral movement into internal networks; in Google-hosted environments, the technique was described as having potential cross-tenant impact by bypassing isolation controls.
A second issue (tracked as CVE-2025-12743) enables exfiltration of Looker’s internal management database by abusing internal connection behavior, allowing attackers to extract sensitive configuration data and credentials. Google has already remediated the issues in its managed Looker (SaaS) on Google Cloud, but self-hosted deployments remain exposed until patched, with guidance to upgrade to fixed releases (including 25.12.30+, 25.10.54+, 25.6.79+, 25.0.89+, 24.18.209+), and clarification that Looker Studio is not affected.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage emphasized that successful exploitation could enable server compromise and lateral movement in self-hosted deployments, and potentially cross-tenant access in some Google Cloud Looker environments where shared infrastructure or secrets were reachable. Google also noted exploitation would require a Looker user with developer permissions.
Public reporting included indicators of compromise for self-hosted Looker environments, such as suspicious files in .git/hooks/ and logs showing abuse of internal database connections like looker__ilooker. The guidance was intended to help administrators detect exploitation attempts.
On February 4, 2026, Tenable publicly disclosed technical details for the two Looker flaws, including the RCE chain using LookML remote dependencies, path traversal, Git hook manipulation, and a race condition, as well as CVE-2025-12743 for internal MySQL database exfiltration via request tampering and error-based SQL injection.
Google made patched Looker versions available for customer-hosted and on-premises deployments, with administrators required to manually upgrade. Releases 25.14 and later were reported as unaffected, and the fixes were referenced in Google's bulletin GCP-2025-052.
Google remediated the two Looker issues in its managed Google Cloud-hosted/SaaS offering shortly after Tenable reported them. The fixes addressed the RCE chain and the internal database exposure risk in hosted environments.
Tenable Research identified two vulnerabilities in Google Looker, later dubbed “LookOut,” including an internal database exfiltration flaw and an RCE exploit chain. Google received the report through its vulnerability disclosure process and began remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcetenable.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at **Tenable** disclosed nine cross-tenant vulnerabilities in **Google Looker Studio** (formerly *Data Studio*), collectively dubbed **LeakyLooker**, that could have allowed attackers to access other tenants’ data sources and run **arbitrary SQL queries** against victims’ connected databases. Reported impacts included potential **data exfiltration** as well as the ability to **insert or delete data** in connected services, with attack paths described as **zero-click and one-click** depending on the vector. Affected connectors and services potentially included **Google Sheets**, **BigQuery**, **Spanner**, **Cloud Storage**, and third-party databases such as **PostgreSQL** and **MySQL**, reflecting Looker Studio’s broad integration surface within Google Cloud environments. The reported issues spanned multiple classes of cross-tenant weaknesses, including **unauthorized access**, **SQL injection** via database connectors and stored credentials, **BigQuery/Spanner query abuse** (including via native functions and APIs), **data source leakage** via hyperlink and image rendering behaviors, an **XS-leak** using frame counting/timing oracles, and a **“denial of wallet”** scenario targeting BigQuery cost exposure. Google remediated the vulnerabilities following responsible disclosure (reported as June 2025), and both sources state there is **no evidence of in-the-wild exploitation** at the time of publication.
Jun 29, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026