New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries

2026-03-13

Researchers found nine cross-tenant issues in Google Looker Studio that allowed arbitrary SQL on connected data sources and broader GCP projects, including BigQuery, Spanner, PostgreSQL, MySQL, and Google Sheets. Attackers could hijack reports, reuse stored credentials, and trigger one-click data exfiltration via crafted reports and browser-side code.