CVE Catalog
CVE-2026-67180
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk0.17%
6th percentile - higher than 6% of all known CVEs
Summary
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.
Risk Assessment
An attacker can take control of the Turbinia infrastructure, potentially leading to data integrity compromise or further attacks within the network.
Recommendation
Update Turbinia to the latest version containing the fix from 2026-07-10.
Original NVD description (English source)
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.