CVE-2026-15810: Google Cloud Looker XSS Vulnerability

CVE-2026-15810 Overview

CVE-2026-15810 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Google Cloud Looker that allows attackers to execute arbitrary JavaScript in the context of authenticated users. Attackers deliver the payload through a maliciously crafted URL. Successful exploitation can lead to administrative account takeover on both Looker-hosted and Self-hosted deployments. Google has already remediated Looker-hosted instances, and no user action is required for those tenants. Self-hosted operators must upgrade to a patched release. The issue affects Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7.

Critical Impact
A single crafted URL clicked by a Looker administrator can result in full administrative account takeover of the analytics environment.

Affected Products

Google Cloud Looker (Looker-hosted) - already mitigated by Google
Google Cloud Looker (Self-hosted) versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7
Looker deployments exposing the web interface to authenticated end users

Discovery Timeline

2026-07-24 - CVE-2026-15810 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-15810

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw in the Looker web application. Looker fails to properly sanitize or encode attacker-controlled input reflected from a URL parameter into a rendered response. When an authenticated user opens the crafted URL, the browser executes the injected JavaScript within the Looker origin. The script runs with the privileges of the victim session, giving it access to session cookies, API tokens, and same-origin requests against the Looker API. If the victim holds administrative privileges, the attacker can perform any action the administrator can, including creating users, modifying permissions, or exfiltrating dashboards and connected datasource credentials.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied input rendered in the Looker interface, mapped to [CWE-79]: Improper Neutralization of Input During Web Page Generation. The application trusts URL-derived values and reflects them into the DOM without contextual escaping.

Attack Vector

The attack requires no authentication on the attacker's part but does require user interaction. An attacker crafts a URL containing a malicious JavaScript payload and delivers it via phishing, chat, embedded link, or a compromised site. When an authenticated Looker user (ideally an administrator) opens the URL, the payload executes in-browser. From there, the attacker can steal session material, invoke Looker administrative APIs, and pivot to hosted data connections. The vulnerability is exploited over the network with low attack complexity.

Vulnerability class: Reflected XSS (CWE-79)
Delivery: Crafted URL against a vulnerable Looker endpoint
Execution context: Victim's authenticated Looker origin
Outcome: Session theft, API abuse, administrative account takeover

Detection Methods for CVE-2026-15810

Indicators of Compromise

Looker access logs containing URL parameters with HTML tags, javascript: URIs, event handlers such as onerror= or onload=, or encoded variants like %3Cscript%3E
Unexpected creation of Looker admin users, API keys, or permission set changes shortly after a user clicked an external link
Anomalous outbound requests from Looker user sessions to attacker-controlled domains
Session token reuse from unfamiliar IP addresses or user agents against /api/ endpoints

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected script patterns in query strings hitting Looker hostnames
Correlate referrer and URL parameters in HTTP proxy logs to identify users who followed crafted URLs into Looker
Alert on privilege changes, new API credential creation, and new SSO or user provisioning events in Looker audit logs

Monitoring Recommendations

Ingest Looker audit and access logs into a centralized SIEM and baseline admin activity by user and source IP
Monitor Content Security Policy (CSP) violation reports if CSP is configured on Self-hosted Looker
Track browser telemetry for administrators, including unexpected script execution or credential prompts on Looker pages

How to Mitigate CVE-2026-15810

Immediate Actions Required

Self-hosted Looker operators must upgrade immediately to one of the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+
Rotate administrator session tokens and API keys after patching to invalidate any credentials that may have been exposed
Review Looker audit logs for suspicious admin activity, new users, or permission changes over the exposure window
Confirm Looker-hosted tenants are on a patched release; no action is required beyond verification per Google

Patch Information

Google released fixed Self-hosted builds 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7. Looker-hosted instances have already been patched by Google and require no customer action. Refer to the Google Cloud Looker Release Notes and the Google Cloud Support Bulletin GCP-2026-049 for full details.

Workarounds

No official workaround exists; upgrading Self-hosted Looker to a patched version is the only supported remediation
Restrict access to the Looker web interface to trusted networks or a VPN until patching is complete
Train administrators to avoid clicking Looker URLs received from untrusted sources during the exposure window
Enforce short session lifetimes and require re-authentication for administrative actions

bash

# Example: verify running Self-hosted Looker version and confirm it is patched
lookerctl version

# Expected output should match one of the patched trains, for example:
#   Looker 26.8.7
#   Looker 26.6.28
#   Looker 25.18.68