CVE-2026-67180: Google Turbinia arbitrary command execution

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-78

Description

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

Affected products

Google Turbinia: before 2026-07-10 — fixed in 2026-07-10

How to fix

Upgrade to a fixed version: Google Turbinia 2026-07-10. Check the vendor advisory for mitigations.

References

https://github.com/google/turbinia/issues/1629
https://github.com/google/turbinia/pull/1631
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-223-02.json
https://www.cve.org/CVERecord?id=CVE-2026-67180

Get alerted when CVE-2026-67180 or the next vulnerability affects your stack