Authorization bypass and SQL injection in Google Looker internal database project generation
CVE-2025-12743 affects Google Looker’s endpoint for generating new projects from database connections. The endpoint improperly allows a user to specify a reserved internal connection name for Looker’s internal MySQL database (described as "looker" in the vendor bulletin; related research also references the internal connection name looker__ilooker). By tampering with the connection parameter, a user with developer permissions can bypass intended restrictions and attach a project to Looker’s internal metadata database. The schemas parameter is then vulnerable to SQL injection, allowing manipulation of SELECT queries executed against that internal MySQL database. Supporting research further indicates the internal database stores Looker metadata, users, and permissions, and that exfiltration can be performed through LookML data-test/error-based query techniques. The issue affects both Looker-hosted and self-hosted deployments, though Google states hosted instances have already been mitigated.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A set/chain of vulnerabilities in Google Looker ("LookOut") enabling full compromise of a Looker instance, including an RCE chain (via Git hook overrides) and an authorization bypass (via internal DB connection abuse), with potential cross-tenant impact and internal database exfiltration.
A set of vulnerabilities in Google Looker (tracked together) enabling an RCE chain and authorization bypass that can lead to full instance compromise and potential cross-tenant access; patched in September 2025.
A vulnerability in Google Looker that allows a user (with developer permissions) to bypass UI restrictions to connect to an internal MySQL metadata database ("looker__ilooker") and exfiltrate data via error-based leakage triggered through Looker features.
An authorization bypass in Google Looker that allows a user to attach a project to an internal (normally restricted) MySQL connection and exfiltrate the full internal Looker database using error-based SQL injection (e.g., updatexml-based error leakage).
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.