Read the docs
TI-2024-08275 Aliases CVE-2024-8912GHSA-wfxr-5r9h-mpvw

HTTP Request Smuggling in Looker

Priority LOW 38CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: * Looker (Google Cloud core) was found to be vulnerable. This issue has already been mitigated and our investigation has found no signs of exploitation. * Looker (original) was not vulnerable to this issue. Customer-hosted Looker instances were found to be vulnerable and must be upgraded. This vulnerability has been patched in all supported versions of customer-hosted Looker, which are available on the Looker download page https://download.looker.com/ . For Looker customer-hosted instances, please update to the latest supported version of Looker as soon as possible. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page: * 23.12 -> 23.12.123+ * 23.18 -> 23.18.117+ * 24.0 -> 24.0.92+ * 24.6 -> 24.6.77+ * 24.8 -> 24.8.66+ * 24.10 -> 24.10.78+ * 24.12 -> 24.12.56+ * 24.14 -> 24.14.37+

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed Looker (Google): 23.12.123, 23.18.117, 24.0.92 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleLooker23.12.0 to before 23.12.123; 23.18.0 to before 23.18.117; 24.0.0 to before 24.0.92; 24.6.0 to before 24.6.77; 24.8.0 to before 24.8.66; 24.10.0 to before 24.10.78; 24.12.0 to before 24.12.56; 24.14.0 to before 24.14.3723.12.123, 23.18.117, 24.0.92, 24.6.77, 24.8.66, 24.10.78, 24.12.56, 24.14.37Patch availableCNA
GoogleLooker23.6 – 24.14—No fix listedCNA
  • Looker VendorGoogle Affected 23.12.0 to before 23.12.123; 23.18.0 to before 23.18.117; 24.0.0 to before 24.0.92; 24.6.0 to before 24.6.77; 24.8.0 to before 24.8.66; 24.10.0 to before 24.10.78; 24.12.0 to before 24.12.56; 24.14.0 to before 24.14.37 Fixed in 23.12.123, 23.18.117, 24.0.92, 24.6.77, 24.8.66, 24.10.78, 24.12.56, 24.14.37 Patch available CNA
  • Looker VendorGoogle Affected 23.6 – 24.14 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:cloud_looker:*:*:*:*:*:*:*:*23.12 to before 23.12.123; 23.18 to before 23.18.117; 24.0 to before 24.0.92; 24.6 to before 24.6.77; 24.8 to before 24.8.66; 24.10 to before 24.10.78; 24.12 to before 24.12.56; 24.14 to before 24.14.37VulnerableGoogle
  • cpe:2.3:a:google:cloud_looker:*:*:*:*:*:*:*:* Versions 23.12 to before 23.12.123; 23.18 to before 23.18.117; 24.0 to before 24.0.92; 24.6 to before 24.6.77; 24.8 to before 24.8.66; 24.10 to before 24.10.78; 24.12 to before 24.12.56; 24.14 to before 24.14.37 Vulnerable ·Google

Remediation

  • Fix · CNA Looker (Google) Fixed in 23.12.123, 23.18.117, 24.0.92, 24.6.77, 24.8.66, 24.10.78, 24.12.56, 24.14.37

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8912
  2. 2026-10-03 Alias added: GHSA-wfxr-5r9h-mpvw

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences