{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15810", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "state": "PUBLISHED", "assignerShortName": "GoogleCloud", "dateReserved": "2026-07-15T10:03:09.218Z", "datePublished": "2026-07-24T11:04:59.022Z", "dateUpdated": "2026-07-24T12:35:11.062Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2026-07-24T11:04:59.022Z"}, "title": "Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Google Cloud", "product": "Looker", "platforms": ["Looker-hosted"], "versions": [{"status": "affected", "version": "0", "lessThan": "25.6.103", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.12.65", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.18.68", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.0.66", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.2.47", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4.36", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.6.28", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.8.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Google Cloud", "product": "Looker", "platforms": ["Self-hosted"], "versions": [{"status": "affected", "version": "0", "lessThan": "25.6.103", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.12.65", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.18.68", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.0.66", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.2.47", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4.36", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.6.28", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.8.7", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL.\n\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances. No user action is required for these.\n\n\nSelf-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL.<div><br></div><div>Looker-hosted and Self-hosted were found to be vulnerable.<br>This issue has already been mitigated for Looker-hosted instances. No user action is required for these.<div><br></div><div>Self-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.</div></div>"}]}], "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-049"}, {"url": "https://docs.cloud.google.com/looker/docs/release-notes#July_22_2026"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber"}}], "solutions": [{"lang": "en", "value": "This vulnerability has been mitigated for Looker-hosted instances, and no user action is required.\n\nFor Self-hosted Looker instances, customers should upgrade to one of the patched versions or later: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This vulnerability has been mitigated for Looker-hosted instances, and no user action is required.<br><br>For Self-hosted Looker instances, customers should upgrade to one of the patched versions or later: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+."}]}], "credits": [{"lang": "en", "value": "Sivanesh Ashok", "type": "reporter"}, {"lang": "en", "value": "Sreeram KL", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T12:34:58.605430Z", "id": "CVE-2026-15810", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T12:35:11.062Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15810", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T12:34:58.605430Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T12:35:03.396Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Sivanesh Ashok"}, {"lang": "en", "type": "reporter", "value": "Sreeram KL"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Google Cloud", "product": "Looker", "versions": [{"status": "affected", "version": "0", "lessThan": "25.6.103", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.12.65", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.18.68", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.0.66", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.2.47", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4.36", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.6.28", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.8.7", "versionType": "custom"}], "platforms": ["Looker-hosted"], "defaultStatus": "unaffected"}, {"vendor": "Google Cloud", "product": "Looker", "versions": [{"status": "affected", "version": "0", "lessThan": "25.6.103", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.12.65", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "25.18.68", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.0.66", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.2.47", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4.36", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.6.28", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.8.7", "versionType": "custom"}], "platforms": ["Self-hosted"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This vulnerability has been mitigated for Looker-hosted instances, and no user action is required.\n\nFor Self-hosted Looker instances, customers should upgrade to one of the patched versions or later: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.", "supportingMedia": [{"type": "text/html", "value": "This vulnerability has been mitigated for Looker-hosted instances, and no user action is required.<br><br>For Self-hosted Looker instances, customers should upgrade to one of the patched versions or later: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.", "base64": false}]}], "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-049"}, {"url": "https://docs.cloud.google.com/looker/docs/release-notes#July_22_2026"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL.\n\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances. No user action is required for these.\n\n\nSelf-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.", "supportingMedia": [{"type": "text/html", "value": "A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL.<div><br></div><div>Looker-hosted and Self-hosted were found to be vulnerable.<br>This issue has already been mitigated for Looker-hosted instances. No user action is required for these.<div><br></div><div>Self-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2026-07-24T11:04:59.022Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15810", "state": "PUBLISHED", "dateUpdated": "2026-07-24T12:35:11.062Z", "dateReserved": "2026-07-15T10:03:09.218Z", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "datePublished": "2026-07-24T11:04:59.022Z", "assignerShortName": "GoogleCloud"}, "dataVersion": "5.2"}

{}

{}

{"affected": [{"configurations": [{"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.6.103)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.12.65)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.18.68)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0.66)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.2.47)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4.36)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.6.28)"}}, {"platform": ["looker-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.8.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Looker", "source": "cna", "vendor": "Google Cloud"}, "product": "cloud_looker", "vendor": "google"}, {"configurations": [{"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.6.103)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.12.65)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.18.68)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0.66)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.2.47)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4.36)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.6.28)"}}, {"platform": ["self-hosted"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.8.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Looker", "source": "cna", "vendor": "Google Cloud"}, "product": "cloud_looker", "vendor": "google"}], "created": "2026-07-24T20:00:05.647540+00:00", "updated": "2026-07-24T20:00:05.647578+00:00", "vendors": ["google", "google$PRODUCT$cloud_looker"]}