CVE Exploit Alert: CVE-2026-33634 | CRITICAL | CVSS 9.4 | Aquasecurity Trivy

CRITICAL

Alert Date: 2026-05-02

Severity Overview

Summary

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

What the Attack Looks Like

If successfully exploited: The lateral movement potential mapped to T1210 means an attacker who gains initial access through this CVE may be able to spread to adjacent systems before detection.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and low-privileged credentials are required. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The CVSS score places this in critical territory, so internet-facing systems and high-value assets should be prioritized for immediate remediation or compensating controls. Because the mapping suggests remote service exploitation potential, defenders should also consider post-compromise lateral movement scenarios during investigation. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

MITRE ATT&CK Mapping

• T1195.002 – Compromise Software Supply Chain
  Rationale: The vulnerability context suggests compromise of software or its delivery/update path.
• T1203 – Exploitation for Client Execution
  Rationale: The vulnerability appears tied to a client application such as a browser, document handler, or end-user productivity software.
• T1210 – Exploitation of Remote Services
  Rationale: The vulnerability context suggests exploitation of services commonly used for remote access or lateral movement.

Detection Guidance

• T1195.002 — Software Supply Chain Compromise
  • Validate integrity of software updates, packages, and repositories associated with the affected product against known-good vendor hashes.
  • Review CI/CD pipeline activity, build logs, and package download history for anomalies around the vulnerability disclosure window.
  • Confirm software was sourced from official vendor channels and that update infrastructure communications match expected vendor endpoints.
• T1203 — Exploitation for Client Execution
  • Inspect endpoint telemetry for suspicious execution chains: scripting engines or download utilities launched as children of browsers, Office applications, PDF readers, or other client-side software.
  • Look for LOLBin usage (certutil, mshta, rundll32, regsvr32, wmic) with suspicious arguments spawned from document-handling parent processes.
  • Review email attachment and file download activity correlated with any suspicious process execution on the same endpoint within the same time window.
• T1210 — Exploitation of Remote Services
  • Monitor SMB, RDP, WinRM, SSH, and RPC activity between internal systems for patterns outside your normal management baseline.
  • Look for authentication bursts: repeated failures (Event ID 4625) from the same source followed by a successful logon (Event ID 4624).
  • Investigate remote execution behavior and lateral movement artifacts (PsExec, WMI remote execution, remote scheduled task creation) originating from recently exposed assets.

Hunting Considerations

These are proactive hunts mapped to the ATT&CK techniques identified for this CVE. Run them now — do not wait for an alert to fire.

• T1195.002 — Software Supply Chain Compromise
  • Binary integrity: Compare hashes of recently updated software packages and executables against known-good values from the vendor’s official release. Unexpected hash changes in software update paths are the primary supply chain indicator.
  • Build system activity: Review CI/CD pipeline logs for unexpected jobs, unauthorized commits, changes to build scripts, or outbound network connections from build servers to external IPs not in your allowlist.
  • Update server communications: Flag connections to update endpoints that do not resolve to known vendor infrastructure. Supply chain attacks commonly involve redirecting update traffic to attacker-controlled servers.
  • Prioritize recently updated systems: Identify all hosts running the affected product version and focus investigation on those that applied updates during the window of potential compromise — an update received during an active supply chain attack is the highest-risk scenario.
• T1203 — Exploitation for Client Execution
  • Parent-child process chains: Search for scripting engines (PowerShell, cmd.exe, wscript.exe, cscript.exe, mshta.exe) or download utilities (certutil, bitsadmin, curl) spawned as direct children of Office applications, browsers, or PDF readers. These chains are rarely legitimate.
  • LOLBin execution: Hunt for Living-off-the-Land Binaries — regsvr32, rundll32, mshta, certutil, wmic, odbcconf — executing from unusual working directories or with command lines containing encoded strings, remote paths, or -enc / -nop / IEX patterns.
  • Network connections from client apps: Flag outbound connections to new external IPs from browser, Office, or document-handling processes that do not match known CDN or update infrastructure. These indicate the exploited process reaching out for a secondary payload.
  • Windows Event IDs: Event 4688 (process creation with full command line) and Sysmon Event 1 are your primary sources. Filter for suspicious parent-child pairs. Sysmon Event 3 (network connection) from document handlers is a high-fidelity indicator.
  • Correlation with delivery: Check email gateway and proxy logs for attachment opens or file downloads on the same host in the 30 minutes before any suspicious process execution — this helps confirm the initial delivery vector.
• T1210 — Exploitation of Remote Services
  • Authentication burst pattern: Hunt for Event ID 4625 (failed logon) followed quickly by Event ID 4624 (successful logon) from the same source IP. This burst — repeated failures then success — is a classic exploitation indicator. Flag unusual Logon Type values: Type 3 (network), Type 10 (RemoteInteractive).
  • Unexpected east-west traffic: Look for new SMB (445), RDP (3389), WinRM (5985/5986), or SSH (22) connections between internal hosts that do not follow normal patterns — especially from workstations to servers or from servers outside your known management tooling.
  • Lateral movement artifacts: Hunt for PsExec service entries (Event ID 7045 with service name “PSEXESVC”), WMI remote execution (wmiprvse.exe spawning child processes), and scheduled tasks created via remote sessions (Event ID 4698).
  • Segmentation gaps: Confirm which affected hosts have network paths to domain controllers, file servers, or databases. Remote service exploitation is substantially more dangerous when segmentation is absent — validate this before concluding triage.
  • Unusual ports: Some exploitation of remote services uses non-standard ports. Cross-reference all new internal connections against your expected service port baseline to catch off-port lateral movement.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running Aquasecurity Trivy. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.
• Apply compensating controls now: For systems that cannot be patched immediately, implement temporary mitigations: restrict access via firewall rules or ACLs, add WAF rules if applicable, disable or isolate the vulnerable component if feasible without breaking critical operations.
• Verify software integrity: Before applying updates, confirm that software packages and update mechanisms have not been tampered with. Compare hashes against vendor-published values.

Remediation

• Apply the vendor patch: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• CISA directive deadline: 2026-04-09 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.
• Post-patch compromise assessment: Privilege escalation and lateral movement techniques can result in persistent access that survives patching. After remediation, review the hunting considerations in this alert to assess whether compromise occurred before the patch was applied.

Detection Coverage

• Verify ATT&CK coverage: Confirm your SIEM and EDR have detection logic in place for T1195.002, T1203, T1210. Review the Detection Guidance and Hunting Considerations sections of this alert for the specific log sources and behavioral patterns to monitor.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

This vulnerability involves a supply‑chain compromise in a product that may be used across multiple products and environments. Additional vendor‑provided guidance must be followed to ensure full remediation. For more information, please see: https://github.com/advisories/GHSA-69fq-xp46-6×23 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33634