CVE-2026-67180: Google Turbinia RCE Vulnerability

CVE-2026-67180 Overview

CVE-2026-67180 is a command injection vulnerability in Google Turbinia, an open-source distributed forensic processing framework. The flaw allows an attacker with permission to submit a processing request, or the ability to influence an evidence path or file name, to execute arbitrary commands on Turbinia worker nodes. The vulnerability is tracked under CWE-78 (OS Command Injection) and was fixed on 2026-07-10.

Critical Impact
Attackers who can shape task inputs gain code execution across the Turbinia worker fleet, exposing forensic evidence, credentials, and adjacent infrastructure.

Affected Products

Google Turbinia (open-source forensic processing framework)
Turbinia worker deployments processing untrusted or attacker-influenced evidence paths
Deployments predating the 2026-07-10 upstream fix

Discovery Timeline

2026-07-10 - Upstream fix released for Google Turbinia
2026-08-11 - CVE-2026-67180 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-67180

Vulnerability Analysis

Google Turbinia orchestrates forensic tasks across a fleet of worker nodes that process disk images and other evidence. The vulnerability is an OS command injection weakness classified under CWE-78. Task execution paths on the worker fleet incorporate user-influenced values, such as evidence file names or paths, into shell command invocations without sufficient sanitization.

An attacker who can submit a processing request, or who controls upstream metadata that feeds an evidence path or name, can inject shell metacharacters. The injected payload executes with the privileges of the Turbinia worker process. Because workers commonly run with elevated rights to mount images and access raw disks, the impact extends beyond user-space compromise.

Root Cause

The underlying defect is the unsafe composition of shell command lines using attacker-influenced strings. Turbinia passes evidence identifiers through code paths that ultimately invoke external forensic tools, and those invocations do not consistently use argument arrays or strict allow-list validation. The upstream discussion and fix are tracked in GitHub Issue #1629 and GitHub Pull Request #1631.

Attack Vector

Exploitation is local to the Turbinia deployment. The attacker needs either the ability to call the request-submission interface or influence over evidence metadata reaching a worker. No user interaction is required. Successful exploitation yields command execution on every worker that processes the crafted task, providing lateral pivot opportunities into cloud project resources, storage buckets, and service account credentials attached to the worker fleet.

No verified public exploit code has been published. See the CVE-2026-67180 record and the CISA CSAF report for authoritative details.

Detection Methods for CVE-2026-67180

Indicators of Compromise

Evidence submissions containing shell metacharacters such as ;, |, `, $(, or newline sequences in file names or paths
Turbinia worker processes spawning unexpected child processes such as sh, bash, curl, wget, python, or nc
Outbound network connections from worker nodes to destinations unrelated to configured storage or task queues
New or modified files in worker home directories, cron paths, or systemd unit directories following task processing

Detection Strategies

Audit Turbinia request logs and evidence manifests for entries whose names or paths contain non-alphanumeric shell characters
Baseline the expected process tree beneath the Turbinia worker service and alert on deviations, especially interactive shells
Correlate task execution timestamps with worker host telemetry to identify commands that do not map to known forensic tooling

Monitoring Recommendations

Enable and forward worker host process, file, and network telemetry to a centralized data lake for retrospective hunting
Monitor the Turbinia API and message queue for requests originating outside expected analyst IP ranges or service accounts
Track service account token usage from worker nodes for anomalous cloud API calls following task execution

How to Mitigate CVE-2026-67180

Immediate Actions Required

Upgrade Turbinia to a version that includes the fix merged on 2026-07-10 via Pull Request #1631
Restrict who can submit processing requests to a small set of authenticated, trusted analysts or automation identities
Validate and sanitize all evidence path and name inputs upstream of Turbinia, rejecting shell metacharacters
Rotate any service account keys or credentials accessible from worker nodes if compromise is suspected

Patch Information

The upstream fix is available in the Google Turbinia repository. Review GitHub Issue #1629 for background and Pull Request #1631 for the code changes. Rebuild and redeploy worker container images so every node in the fleet runs the patched code path.

Workarounds

Run Turbinia workers under least-privileged service accounts with scoped IAM roles and no broad project-level access
Isolate worker nodes on a dedicated network segment with egress restricted to required storage, queue, and logging endpoints
Enforce an allow-list of accepted evidence path patterns at the ingestion layer, rejecting names containing shell metacharacters
Enable mandatory access controls such as AppArmor or SELinux profiles on worker hosts to constrain command execution

bash

# Example ingestion-layer allow-list check for evidence names
if [[ ! "$EVIDENCE_NAME" =~ ^[A-Za-z0-9._-]+$ ]]; then
  echo "Rejected: evidence name contains disallowed characters" >&2
  exit 1
fi