CVE-2026-33634

Description

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

Overview

State

PUBLISHED

Assigner (CNA)

GitHub_M

CVSS severity

CRITICAL

CVSS score

9.4 / 10

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Effective score

9.4 / 10 CRITICAL source: CNA overview

CWE(s)

CWE-506

Reserved

2026-03-23

Published

2026-03-23 21:47 UTC

Last updated

2026-03-30 14:40 UTC

Source

https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33634.json

Linked Threat

CVE-2026-33634 — Aquasecurity Trivy: Aquasecurity Trivy Embedded Malicious Code Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Vendor / project

Aquasecurity

Product

Trivy

Date added to KEV

2026-03-26

Remediation due

2026-04-09

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaign use

Unknown

CISA notes

This vulnerability involves a supply‑chain compromise in a product that may be used across multiple products and environments. Additional vendor‑provided guidance must be followed to ensure full remediation. For more information, please see: https://github.com/advisories/GHSA-69fq-xp46-6x23 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33634

CISA listing

www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-03-23 22:16:31 UTC

NVD last modified

2026-03-30 18:50:38 UTC

NVD CVSS v3.1

8.8 / 10 HIGH source: nvd@nist.gov

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

2.8 / 10

Impact subscore

5.9 / 10

EPSS score

0.2390 (probability of exploitation in next 30 days)

EPSS percentile

96.12% vs all CVEs — higher = more likely to be exploited, as of 2026-06-03

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-14601

Assigner

GitHub_M

Published

Mar 23, 2026, 9:47:29 PM

Updated

Mar 30, 2026, 2:40:28 PM

EUVD base score (CVSS 4.0)

9.4 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EUVD-reported EPSS

29.3600

Vendors

team-telnyx, berriai, aquasecurity

Products

trivy (= 0.6.94)

telnyx (4.87.1, ≤ 4.87.2)

trivy (= 0.69.4)

LiteLLM (1.82.7, ≤ 1.82.8)

trivy-action (<0.35.0)

setup-trivy (< 0.2.6)

trivy-action (< 0.35.0)

Aliases

GHSA-69fq-xp46-6x23

ENISA description: Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

Vendor references (10)

References embedded in the original CVE record by the assigning CNA.

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 x_refsource_CONFIRM
• https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc x_refsource_MISC
• https://github.com/BerriAI/litellm/issues/24518 x_refsource_MISC
• https://docs.litellm.ai/blog/security-update-march-2026 x_refsource_MISC
• https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack x_refsource_MISC
• https://github.com/aquasecurity/trivy/discussions/10425 x_refsource_MISC
• https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml x_refsource_MISC
• https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py#line.130 x_refsource_MISC
• https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellm_init.pth#line.1 x_refsource_MISC
• https://www.wiz.io/blog/teampcp-attack-kics-github-action x_refsource_MISC

MITRE references (8) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

• https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc x_refsource_MISC
• https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py#line.130 x_refsource_MISC
• https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellm_init.pth#line.1 x_refsource_MISC
• https://github.com/BerriAI/litellm/issues/24518 x_refsource_MISC
• https://www.wiz.io/blog/teampcp-attack-kics-github-action x_refsource_MISC
• https://docs.litellm.ai/blog/security-update-march-2026 x_refsource_MISC
• https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack x_refsource_MISC
• https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml x_refsource_MISC

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 rapid7:github.com
• https://attackerkb.com/topics/CVE-2026-33634 rapid7:attackerkb.com
• https://github.com/aquasecurity/trivy/discussions/10425 rapid7:github.com
• http://cwe.mitre.org/data/definitions/506.html rapid7:cwe.mitre.org
• https://www.cve.org/CVERecord?id=CVE-2026-33634 rapid7:www.cve.org

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-14 11:46 UTC
• Microsoft Patch Tuesday for March 2026 — Snort rules and prominent ...
  web:blog.talosintelligence.com

  Microsoft has released its monthly security update for March 2026 which includes 79 vulnerabilities, including three that Microsoft marked as "critical." The remaining vulnerabilities listed are classified as "important." Microsoft assessed that exploitation of the three "critical" vulnerabilities is "less likely." CVE - 2026 -26110 and CVE - 2026 -26113 are "critical" Microsoft ...

  2026-05-14 11:46 UTC
• CVE-2026-33634: CVE-2026-33634: Remote Supply Chain Compromise in Trivy ...
  web:cvereports.com

  A highly critical supply chain compromise affecting the Aqua Security Trivy ecosystem, including the core scanner and its associated GitHub Actions. The attack, attributed to the threat actor TeamPCP, leveraged compromised CI/CD credentials and non-atomic secret rotation to embed malicious code within official releases. This embedded infostealer targets ephemeral runner environments to extract ...

  2026-05-14 11:46 UTC
• Microsoft addresses 137 vulnerabilities in May's Patch Tuesday ...
  web:cyberscoop.com

  Threats Microsoft addresses 137 vulnerabilities in May's Patch Tuesday, including 13 rated critical The high volume of vulnerabilities reflects a growing trend researchers have been anticipating as artificial intelligence models are deployed to find previously uncovered defects in code.

  2026-05-14 11:46 UTC
• Microsoft Patch Tuesday April 2026 - 168 Vulnerabilities Fixed ...
  web:cybersecuritynews.com

  Microsoft has released its April 2026 Patch Tuesday security update, addressing 168 vulnerabilities across its product portfolio including one actively exploited zero-day and one publicly disclosed flaw that organizations must prioritize immediately.

  2026-05-14 11:46 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-05-14 11:46 UTC
• CVE-2026-33634 - Vulnerability Details - OpenCVE
  web:app.opencve.io

  Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade Aquasec Trivy to a safe release (0.69.2 or 0.69.3) and upgrade or roll forward to trivy‑action 0.35.0 and setup‑trivy 0.2.6; do not use version 0.69.4 or any unvalidated tags.

  2026-05-14 11:46 UTC
• Critical Patches Issued for Microsoft Products, April 14, 2026
  web:www.cisecurity.org

  <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

  2026-05-14 11:46 UTC
• CISA Required Action
  CISA KEV

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-04-09 Known ransomware campaign use: Unknown

  2026-05-14 01:13 UTC

Only Available for Registered Users. Sign in to view.