Looker Studio vulnerabilities

An improper privilege management vulnerability in Looker Studio affects all JDBC-based connectors. A user with report view access could copy the report and execute arbitrary SQL on the data source database using stored credentials. This was patched on 21 July 2025, no customer action is needed.

A SQL injection vulnerability in Looker Studio allowed data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled and having the victim access it, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This was patched on 07 July 2025, no customer action is needed.

A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed.