GCP-2026-049
Cybersecurity Classified by Officially
Published: 2026-07-22
Description
Description Severity NotesA reflected Cross-Site Scripting (XSS) vulnerability was discovered in Google Cloud Looker. An attacker could craft a malicious URL that, when opened by an authenticated administrator, would allow the attacker to execute arbitrary scripts on their behalf and potentially compromise the administrator account.
What should I do?
For Looker-hosted instances, no action is required.
For self-hosted Looker instances, update your Looker instances as soon as possible. This vulnerability has been patched in all supported versions of Looker for self-hosted instances. The following versions have all been updated to fix this vulnerability:
- Looker 26.8.7 and all later versions
- Looker 26.6.28+
- Looker 26.4.36+
- Looker 26.2.47+
- Looker 26.0.66+
- Looker 25.18.68+
- Looker 25.12.65+
- Looker 25.6.103+
What vulnerabilities are being addressed?
For more information, see CVE-2026-15810.
HighThis is an extract. The publication continues at the source.
Read the original at the source: https://docs.cloud.google.com/support/bulletins/index#gcp-2026-049
Officially imported this from Google’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
This publication has changed since it was first published
4 versions recorded. The original is kept in full — nothing is overwritten.
- v4 imported change on current
- v3 imported change on
- v2 imported change on
- v1 as first published on
Provenance
- Organization
- Google — imported from official source
- Official source
- https://cloud.google.com/feeds/google-cloud-security-bulletins.xml RSS
- Imported
- September 15, 2026 20:57
- Versions
- 4 recorded
- Identity
tag:google.com,2016:google-cloud-security-bulletins#gcp-2026-049