# LeakyLooker: Google Looker Studio Cross-Tenant SQL Vulnerabilities

> Discover how nine vulnerabilities in Google Looker Studio, dubbed LeakyLooker, allowed cross-tenant SQL queries and sensitive data exfiltration in GCP.

- Published: 2026-03-10T16:27:19.000Z
- Severity: medium
- Category: Cloud Security
- Tags: Google Looker Studio, LeakyLooker, GCP Security, SQL Injection, Cross Tenant, Tenable
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/03/new-leakylooker-flaws-in-google-looker.html
- Canonical: https://runtimerebel.com/blog/leakylooker-google-looker-studio-cross-tenant-sql-vulnerabilities

## Key points

- Attackers could execute arbitrary SQL queries against victim databases to exfiltrate sensitive data across Google Cloud organization boundaries.
- These vulnerabilities affected Google Looker Studio configurations that relied on cross-tenant data connectors and service account permissions.
- Organizations should review Looker Studio permissions and ensure all Google-managed patches are applied to their cloud environment.

## Understanding the LeakyLooker Vulnerabilities in Google Looker Studio

Researchers at Tenable recently identified a set of nine vulnerabilities, collectively titled "LeakyLooker," within the Google Looker Studio environment. According to [The Hacker News](https://thehackernews.com/2026/03/new-leakylooker-flaws-in-google-looker.html), these flaws could have allowed a malicious actor to perform cross-tenant SQL queries, effectively bypassing the isolation boundaries that typically separate different organizations' data within Google Cloud. While Google has since mitigated these issues, the findings highlight significant risks associated with third-party data connectors and cloud-based business intelligence tools.

### Technical Analysis of Cross-Tenant SQL Execution

The core of the LeakyLooker discovery involves how Looker Studio handles data source connections. A [CVE](/glossary#cve) was not explicitly assigned to each of the nine individual flaws in the initial report, but the collective impact mirrors that of a high-severity SQL injection or [RCE](/glossary#rce) in terms of data access. The vulnerabilities leveraged weaknesses in the underlying service accounts used by Looker Studio to interact with BigQuery and other Google Cloud databases.

By manipulating the request parameters sent to the Looker Studio backend, researchers found they could coerce the system into executing queries against databases belonging to other tenants. This form of [Privilege Escalation](/glossary#privilege-escalation) is particularly dangerous because it undermines the foundational security premise of a [Zero Trust](/glossary#zero-trust) architecture, where access should be strictly limited based on identity and context. If an attacker knows the project ID or schema structure of a target organization, they could potentially extract proprietary information without direct authentication to the target environment.

### How to Detect LeakyLooker Exploit Patterns

Security teams monitoring their [SOC](/glossary#soc) alerts should look for unusual query patterns originating from Google-managed service accounts. While Google manages the backend infrastructure, observing abnormal data egress via [SIEM](/glossary#siem) logs can provide early indicators of compromise. Security professionals researching these threats often look for instructions on how to detect LeakyLooker exploit attempts within their cloud audit trails.

An attacker exploiting these flaws would likely attempt [Lateral Movement](/glossary#lateral-movement) within the cloud environment after gaining initial database access. Defenders should analyze Cloud Audit Logs for BigQuery for any `JobInsertion` events that seem disparate from typical user behavior or scheduled reporting tasks. Developing a Google Looker Studio SQL injection mitigation strategy involves auditing these logs for queries that target datasets outside of the expected organizational scope.

## Strategic Recommendations to Mitigate Cross-Tenant Vulnerabilities in GCP

Organizations utilizing Google Cloud should prioritize the following actions to harden their data environments and ensure they are protected against similar cross-tenant discovery techniques:

*   **Audit Data Connectors**: Regularly review the permissions granted to Looker Studio data sources. Ensure that service accounts follow the principle of least privilege, restricting access only to the datasets required for specific reports. 
*   **Monitor Service Account Activity**: Use [EDR](/glossary#edr) and cloud-native monitoring tools to track the behavior of identities associated with business intelligence platforms. Any deviation from the established baseline of [TTP](/glossary#ttp)s should trigger an immediate investigation.
*   **Implement VPC Service Controls**: By wrapping sensitive data in VPC Service Controls, organizations can add an additional layer of protection that prevents data from being exfiltrated to unauthorized projects, even if a vulnerability like LeakyLooker is present.

The discovery of LeakyLooker underscores the persistent challenge of securing complex [Supply Chain Attack](/glossary#supply-chain-attack) surfaces in cloud-native applications. Even when a [Zero-Day](/glossary#zero-day) vulnerability is identified in a managed service, the shared responsibility model dictates that customers must remain vigilant in how they configure and monitor their data assets. While no active exploitation has been reported, the potential for cross-tenant data exposure serves as a reminder that [MITRE ATT&CK](/glossary#mitre-att-ck) frameworks should be applied to cloud analytics platforms as rigorously as they are to traditional infrastructure. Organizations should continuously validate their cloud identity and access management (IAM) policies to prevent unauthorized data access.

**Related:** [Ivanti EPM CVE-2024-29824 Exploited: Technical Analysis and Patching](/blog/ivanti-epm-cve-2024-29824-exploited-technical-analysis-and-patching), [Critical RCE Flaws in InSAT MasterSCADA BUK-TS Affect ICS](/blog/critical-rce-flaws-in-insat-masterscada-buk-ts-affect-ics)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/leakylooker-google-looker-studio-cross-tenant-sql-vulnerabilities