CVE-2025-12743

The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.106 * 24.18.198+ * 25.0.75 * 25.6.63+ * 25.8.45+ * 25.10.33+ * 25.12.1+ * 25.14+

• CWE-89

• https://cloud.google.com/support/bulletins#gcp-2025-052
• https://www.tenable.com/security/research/tra-2025-43

Published

Nov 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12738Neo4j Enterprise edition versions prior to 2025.11.2 and 5.2…1.3
• CVE-2025-12739An attacker with viewer permissions in Looker could craft a …7.3
• CVE-2025-1274A maliciously crafted RCS file, when parsed through Autodesk…7.8
• CVE-2025-12740A Looker user with a Developer role could create a database …7.7
• CVE-2025-12741A Looker user with Developer role could create a database co…7.7
• CVE-2025-12742A Looker user with a Developer role could cause Looker to ex…7.5
• CVE-2025-12744A flaw was found in the ABRT daemon’s handling of user-suppl…8.8
• CVE-2025-12745A weakness has been identified in QuickJS up to eb2c89087def…7.8
• CVE-2025-12746The Tainacan plugin for WordPress is vulnerable to Reflected…6.1
• CVE-2025-12747The Tainacan plugin for WordPress is vulnerable to Informati…5.3
• CVE-2025-12748A flaw was discovered in libvirt in the XML file processing.…5.5
• CVE-2025-1275A maliciously crafted JPG file, when linked or imported into…7.8