LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

Tenable Research reported two critical "LookOut" vulnerabilities in Google Looker: an RCE via Git hooks config override and path traversal that can allow arbitrary code execution and potential cross-tenant access in cloud environments, and an authorization bypass that enables attachment to Looker's internal MySQL connections and full database exfiltration via error-based SQL injection; Google patched managed Looker instances, but customer-hosted/on-prem deployments must upgrade to specified patched versions immediately.