CVE-2026-33634

What it actually does

This is a software supply-chain compromise affecting Trivy and related GitHub Actions. A malicious Trivy v0.69.4 release and malicious rewrites of mutable GitHub Action version tags for aquasecurity/trivy-action and aquasecurity/setup-trivy could execute attacker-controlled code inside CI/CD workflows or systems that installed the affected scanner. Because these tools commonly run in build pipelines with access to repository tokens, cloud credentials, package registry credentials, signing keys, and deployment secrets, successful execution could expose secrets, modify build artifacts, alter source repositories, or provide persistence in development and release infrastructure. The incident involved force-pushed tags, so workflows that referenced version tags instead of immutable commit SHAs could have run malicious code without an explicit dependency change.

Why it matters to the business

Organizations that ran the compromised Trivy release or affected GitHub Actions should assume credentials available to those jobs may have been stolen. This can lead to unauthorized source-code access, poisoned builds, package or container registry compromise, cloud account abuse, data theft, service disruption, and follow-on compromise of downstream customers or users. The risk is urgent because exploitation is known in the wild, the issue is in CISA KEV with a remediation deadline of 2026-04-09, EPSS is high, and Trivy is commonly embedded in CI/CD and container security workflows across many ecosystems, including downstream projects that may have indirectly used the affected actions or images.

How an attack unfolds

An attacker first obtained or retained valid maintainer credentials from an earlier supply-chain compromise and used them to publish or replace trusted Trivy-related artifacts. The attacker published a malicious Trivy v0.69.4 release, force-pushed most aquasecurity/trivy-action version tags to malicious commits, and replaced aquasecurity/setup-trivy tags with malicious commits. A victim workflow that installed Trivy v0.69.4 or referenced one of the mutable GitHub Action tags would execute the malicious code during CI/CD. The malware then attempted to steal credentials and secrets exposed to the workflow environment. If normal exfiltration failed, a fallback mechanism could create or use a repository named tpcp-docs as evidence that secrets were successfully stolen. Stolen tokens could then be used for repository access, package publication, cloud access, lateral movement, or additional supply-chain compromise. Threat reporting associates exploitation with the Trivy embedded malicious code campaign and references the Interlock ransomware campaign, so organizations should also consider the possibility of hands-on-keyboard follow-on activity after secret theft.

How to fix it

Immediately remove Trivy v0.69.4 and any cached artifacts, containers, binaries, or mirrors that may contain it. Use known safe Trivy versions such as v0.69.2 or v0.69.3, or upgrade to a later verified safe release from the vendor. For aquasecurity/trivy-action, move to v0.35.0 or later and pin the action to a full immutable commit SHA rather than a mutable version tag. For aquasecurity/setup-trivy, use the recreated safe v0.2.6 or later and pin to a full commit SHA. Review all workflows that reference aquasecurity/trivy-action versions 0.0.1 through 0.34.2 or aquasecurity/setup-trivy versions 0.2.0 through 0.2.6 by tag. If any affected component may have run, treat all secrets available to those workflows as exposed: rotate GitHub tokens, repository deploy keys, CI/CD secrets, cloud credentials, package registry tokens, container registry credentials, signing keys, webhook secrets, and any downstream credentials reachable from the pipeline. Revoke stale credentials atomically where possible, invalidate active sessions, review repository permissions, and remove unnecessary workflow secret access. Purge caches and rebuild artifacts generated during the exposure window from trusted sources.

How to confirm the fix worked

Confirm that no workflow, build image, dependency lock file, Dockerfile, script, or automation references Trivy v0.69.4, aquasecurity/trivy-action tags 0.0.1 through 0.34.2, or aquasecurity/setup-trivy tags 0.2.0 through 0.2.6 unless pinned to a verified safe commit. Check GitHub Actions workflow run history, dependency manifests, build logs, container image layers, package caches, artifact repositories, and internal mirrors for pulls or executions of Trivy v0.69.4, especially during March 19–20, 2026. Validate that trivy-action is upgraded to v0.35.0 or later, setup-trivy is using the safe recreated v0.2.6 or later, and all GitHub Actions are pinned to immutable commit SHAs. Verify that all exposed secrets have been rotated after the last possible execution of an affected artifact. Search the GitHub organization or source-control platform for unexpected repositories named tpcp-docs and investigate immediately if found. Re-run builds from clean runners and trusted dependencies, and compare produced artifacts against known-good builds where feasible.

Typical attack path

1. Compromise or retain access to maintainer credentials or release automation tokens.
2. Publish a malicious Trivy v0.69.4 binary or container image and rewrite GitHub Action version tags for aquasecurity/trivy-action or aquasecurity/setup-trivy.
3. Wait for CI/CD workflows or automation to pull the trusted-looking release or mutable version tag.
4. Execute malicious code inside the build or security scanning job.
5. Collect environment variables, GitHub tokens, cloud credentials, package registry tokens, signing keys, or other secrets accessible to the pipeline.
6. Exfiltrate stolen secrets, potentially using a fallback mechanism involving a repository named tpcp-docs.
7. Use stolen credentials for repository access, artifact tampering, package publication, cloud abuse, lateral movement, or ransomware/extortion follow-on activity.

How to detect it

Investigate CI/CD, source-control, artifact, and endpoint telemetry for evidence that compromised Trivy artifacts executed or that stolen credentials were used afterward. Primary sources include GitHub Actions workflow logs, GitHub organization audit logs, repository event logs, runner filesystem artifacts, package and container registry access logs, artifact repository download logs, cloud audit logs, secret manager logs, proxy/DNS/firewall logs from CI runners, and EDR telemetry on self-hosted runners or build hosts. Search for workflow runs on March 19–20, 2026 that used aquasecurity/trivy-action or aquasecurity/setup-trivy by version tag instead of full commit SHA, or that downloaded Trivy v0.69.4. Look for force-pushed or unexpected action references, new or modified workflow files, unexpected repository creation, especially tpcp-docs, and suspicious token activity following workflow execution. In GitHub audit logs, review repository.create, git.push, org.update_actions_secret, repo.add_member, repo.add_deploy_key, hook.create, oauth_authorization events, and unusual use of GITHUB_TOKEN or personal access tokens. On runners, look for cached Trivy v0.69.4 binaries/images, action checkout directories for aquasecurity/trivy-action and aquasecurity/setup-trivy, unexpected scripts, credential harvesting behavior, outbound connections during scanner setup, and post-job cleanup anomalies. Because the main objective was credential theft, absence of malware files does not prove safety; prioritize confirmation of whether affected code ran and whether any credentials available at that time were subsequently used from unusual IP addresses, geographies, user agents, or automation contexts.

• Trivy v0.69.4
• trivy_0.69.4
• aquasecurity/trivy-action
• aquasecurity/setup-trivy
• uses: aquasecurity/trivy-action@v0.34.2
• uses: aquasecurity/trivy-action@v0.34.1
• uses: aquasecurity/trivy-action@v0.34.0
• uses: aquasecurity/trivy-action@v0.
• uses: aquasecurity/setup-trivy@v0.2.6
• uses: aquasecurity/setup-trivy@v0.2.5
• uses: aquasecurity/setup-trivy@v0.2.4
• uses: aquasecurity/setup-trivy@v0.2.
• tpcp-docs
• repository.create
• repo.add_deploy_key
• hook.create
• oauth_authorization
• org.update_actions_secret
• force-push
• github.com/aquasecurity/trivy-action
• github.com/aquasecurity/setup-trivy
• ghcr.io/aquasecurity/trivy:0.69.4
• aquasec/trivy:0.69.4

What your security team should do

• Treat any execution of Trivy v0.69.4 or affected aquasecurity/trivy-action/setup-trivy tags as a credential exposure event, not only a vulnerable software finding.
• Prioritize remediation immediately because the vulnerability is in CISA KEV, exploitation is active in the wild, EPSS is high, and the KEV due date is 2026-04-09.
• Inventory all CI/CD workflows, reusable workflows, build containers, internal templates, and developer scripts that install Trivy or use aquasecurity/trivy-action or aquasecurity/setup-trivy.
• Rotate all secrets accessible to affected workflows, including GitHub tokens, cloud keys, package registry tokens, container registry credentials, deploy keys, and signing credentials.
• Search March 19–20, 2026 workflow logs and source-control audit logs for evidence of malicious action execution, repository creation, suspicious token use, and unexpected outbound network activity.
• Look specifically for repositories named tpcp-docs and investigate them as potential evidence of fallback secret exfiltration.
• Pin GitHub Actions to full commit SHAs and enforce policy controls that block mutable tag references in CI/CD workflows.
• Purge affected binaries, containers, caches, and generated artifacts from runners, registries, mirrors, artifact stores, and developer systems.
• Review repository and organization audit logs for unusual tag changes, workflow modifications, token creation, secret reads or updates, new deploy keys, new webhooks, and unexpected collaborators.
• Assess downstream impact where compromised CI/CD credentials could have allowed publication of malicious packages, containers, releases, or deployment artifacts.