🔴 CRITICAL
Severity Overview
- CVSS Base Score: 9.4
- Severity: CRITICAL
- CVSS Version: 4.0
- Priority: Critical priority
Summary
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one’s environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one’s organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one’s GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don’t use mutable version tags.
Analyst Takeaway
This vulnerability is already in CISA KEV, which means exploitation has been observed in the wild and the issue should be treated as active risk rather than theoretical exposure. The CVSS score places this in critical territory, so internet-facing systems and high-value assets should be prioritized for immediate remediation or compensating controls. Because the mapping suggests remote service exploitation potential, defenders should also consider post-compromise lateral movement scenarios during investigation. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.
MITRE ATT&CK Mapping
- T1195.002 – Compromise Software Supply Chain
Rationale: The vulnerability context suggests compromise of software or its delivery/update path. - T1203 – Exploitation for Client Execution
Rationale: The vulnerability appears tied to a client application such as a browser, document handler, or end-user productivity software. - T1210 – Exploitation of Remote Services
Rationale: The vulnerability context suggests exploitation of services commonly used for remote access or lateral movement.
Detection Guidance
-
T1195.002 – Software Supply Chain Compromise
- Validate integrity of software updates, packages, and repositories associated with the affected product.
- Review CI/CD activity, build pipelines, package download logs, and artifact trust controls.
- Investigate anomalies related to update sources, code signing, or dependency provenance.
- Confirm that affected software was sourced from trusted channels and has not been replaced or tampered with.
-
T1203 – Exploitation for Client Execution
- Inspect endpoint telemetry for suspicious execution chains involving browsers, Office apps, PDF readers, or other client software.
- Look for child processes spawned from user-facing applications, especially PowerShell, cmd.exe, wscript, cscript, or mshta.
- Review email attachment and download activity associated with the affected software.
- Investigate unusual script execution, LOLBin usage, or user-driven process launches immediately following file open events.
-
T1210 – Exploitation of Remote Services
- Monitor SMB, RDP, WinRM, SSH, RPC, or similar remote service activity between internal systems.
- Look for authentication bursts, repeated failures followed by success, or unusual east-west traffic patterns.
- Investigate remote execution behavior originating from recently exposed or compromised assets.
- Review segmentation controls and validate whether affected systems can move laterally to higher-value targets.
Hunting Considerations
- Search SIEM and EDR data for activity aligned to the mapped ATT&CK techniques.
- Correlate endpoint, network, identity, and application telemetry for signs of exploitation and post-exploitation behavior.
- Prioritize internet-facing systems, externally reachable management interfaces, and assets handling sensitive data.
- Investigate unexpected process creation, service changes, outbound connections, or authentication anomalies on affected hosts.
Key Details
- CVE: CVE-2026-33634
- Vendor: Aquasecurity
- Product: Trivy
- CWE: CWE-506
- Date Added to CISA KEV: 2026-03-26
- CISA Due Date: 2026-04-09
- Known Ransomware Campaign Use: Unknown
Technical Severity Details
- CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Why This Matters
This vulnerability is included in CISA’s Known Exploited Vulnerabilities catalog, which means exploitation has been observed in the wild. Based on the available NVD scoring, this issue should be treated as critical priority.
Recommended Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Additional Notes
This vulnerability involves a supply‑chain compromise in a product that may be used across multiple products and environments. Additional vendor‑provided guidance must be followed to ensure full remediation. For more information, please see: https://github.com/advisories/GHSA-69fq-xp46-6×23 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33634