Arbitrary Command Execution in Google Turbinia
CVE-2026-67180

7.5HIGH

Key Information:

Vendor: Google
Status: Turbinia
Vendor: CVE Published:; 11 August 2026

🔔 Create Google Vulnerability Alert

What is CVE-2026-67180?

Google Turbinia is susceptible to arbitrary command execution through its worker tasks. An attacker with the necessary privileges to submit a processing request or manipulate evidence paths can execute code on the worker fleet. This vulnerability exposes systems to potential unauthorized actions, emphasizing the importance of timely updates and security patches.

Affected Version(s)

Turbinia 0

Turbinia 0 < 2026-07-10

Turbinia 2026-07-10

References

https://github.com/google/turbinia/issues/1629

https://github.com/google/turbinia/pull/1631

https://www.cve.org/CVERecord?id=CVE-2026-67180

CVSS V4

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 11, 2026
Vulnerability Reserved
Jul 28, 2026

Credit

George Chen

CVE-2026-67180 Data

.