Cybersecurity researchers have disclosed a set of nine critical vulnerabilities in Google Looker Studio, a business intelligence and data visualization platform. The flaws, discovered by the security firm Tenable, could have allowed attackers to execute unauthorized SQL queries on databases belonging to other organizations within the Google Cloud environment. The disclosure was made public this week, highlighting a significant risk to data isolation in multi-tenant cloud services.

Collectively named “LeakyLooker” by its discoverers, these security shortcomings posed a direct threat to the confidentiality of sensitive corporate information. Successful exploitation could have led to the exfiltration of private data from one organization’s Looker Studio instance by an attacker operating from a separate, compromised tenant. The core issue involved improper access controls that failed to adequately segregate user queries between different customers.

Technical Scope and Immediate Response

The vulnerabilities resided within the Looker Studio service itself, not within customers’ underlying database engines. This meant an attacker could craft malicious requests through a Looker Studio connection they controlled to target and query data sources from an entirely different organization. The potential impact was broad, affecting any organization using the platform to analyze data from Google BigQuery, PostgreSQL, MySQL, and other supported databases.

Upon discovery, Tenable researchers followed coordinated Vulnerability disclosure protocols, reporting the flaws to Google. Google’s security team acknowledged the report and subsequently developed and deployed patches to address all identified issues. The company has confirmed that the vulnerabilities have been fully remediated in the Looker Studio service. There is no evidence, according to either Tenable or Google, that these specific flaws were exploited in the wild before the fixes were applied.

Background on Looker Studio and Cloud Security

Looker Studio, formerly known as Google Data Studio, is a widely used tool for creating interactive dashboards and reports. It connects directly to various data sources, making it a central point for business analytics. The “LeakyLooker” incident underscores the persistent security challenges inherent in complex, multi-tenant SaaS platforms, where a single software flaw can inadvertently bridge the isolation between customers.

This class of vulnerability, known as cross-tenant data access, is a high-priority concern for cloud providers and their clients. It violates the fundamental expectation that one customer’s data and operations are completely walled off from another’s within the shared infrastructure. Such breaches can lead to severe compliance violations, financial loss, and reputational damage.

Industry Reactions and Best Practices

The disclosure has prompted security experts to reiterate standard advice for organizations using cloud-based analytics and business intelligence tools. Recommendations include enforcing the principle of least privilege on all data connections, regularly auditing access logs for anomalous query patterns, and ensuring all linked data sources have their own robust access controls independent of the BI tool’s security.

While Google has resolved the specific technical vulnerabilities, the event serves as a reminder that cloud security is a shared responsibility. Providers must secure their platforms, but customers must also configure their deployments and data permissions with a security-first mindset. Proactive monitoring for unusual data access or export activity remains a critical defensive measure.

Next Steps and Ongoing Vigilance

Google has completed the rollout of patches for the Looker Studio service. The company typically does not disclose detailed timelines for such internal security updates but has confirmed the fixes are active. Users of the platform do not need to take any specific action, as the corrections were applied server-side.

Looking forward, security researchers and cloud providers are expected to continue scrutinizing multi-tenant architectures for similar logical flaws. The “LeakyLooker” findings will likely influence future security assessments of other software-as-a-service offerings. Organizations are advised to stay informed about security bulletins from their cloud service providers and to participate in any vulnerability disclosure programs offered.

Source: Tenable Research, Google Security