CVE-2026-33634
Aquasecurity Trivy Embedded Malicious Code Vulnerability
Description
CVE-2026-33634 is a HIGH severity supply chain attack vulnerability (CWE-506) in Aquasecurity Trivy, a widely used open-source container and infrastructure vulnerability scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push tags in trivy-action to credential-stealing malware, and replaced tags in setup-trivy with malicious commits. This was a continuation of a broader supply chain attack campaign from late February 2026 that also affected litellm and telnyx packages. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The EPSS score of 20.839% (95.6th percentile) indicates extremely high exploitation activity. CISA added CVE-2026-33634 to the KEV catalog on March 26, 2026, with a remediation deadline of April 9, 2026. The KEV entry does not associate this vulnerability with known ransomware campaigns. Affected components include setup-trivy < 0.2.6, trivy 0.69.4, trivy-action < 0.35.0, litellm 1.82.7-1.82.8, and telnyx 4.87.1-4.87.2.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| aquasec | setup-trivy | < 0.2.6 |
| aquasec | trivy | 0.69.4 |
| aquasec | trivy action | < 0.35.0 |
| litellm | litellm | 1.82.7; 1.82.8 |
| telnyx | telnyx | 4.87.1; 4.87.2 |
References
- https://docs.litellm.ai/blog/security-update-march-2026(Third Party Advisory)
- https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack(Third Party Advisory)
- https://github.com/BerriAI/litellm/issues/24518(Issue Tracking, Mitigation, Third Party Advisory)
- https://github.com/aquasecurity/trivy/discussions/10425(Issue Tracking, Vendor Advisory)
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23(Exploit, Mitigation, Vendor Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml(Third Party Advisory)
- https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc(Third Party Advisory)
- https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py#line.130(Broken Link)
- https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellm_init.pth#line.1(Broken Link)
- https://www.wiz.io/blog/teampcp-attack-kics-github-action(Not Applicable)
- https://github.com/BerriAI/litellm/issues/24518#issuecomment-4127436387(Issue Tracking, Mitigation, Third Party Advisory)
- https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33634(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/(Technical Description)
Weakness Type
CWE-506: Embedded Malicious Code
Embedded Malicious Code is a vulnerability class where software contains code that has been intentionally inserted to perform unauthorized actions. Unlike vulnerabilities that arise from programming errors, CWE-506 represents deliberate tampering — the insertion of backdoors, data exfiltration logic, or other malicious functionality by a threat actor who has gained access to the software distribution channel. This weakness is characteristic of supply chain attacks where trusted software repositories, build systems, or package registries are compromised.
In CVE-2026-33634, a threat actor compromised Aquasecurity's credentials and used them to inject malicious code into multiple components of the Trivy ecosystem. The malicious Trivy v0.69.4 release and modified GitHub Actions (trivy-action, setup-trivy) contained credential-stealing malware designed to exfiltrate CI/CD environment variables, secrets, and authentication tokens from every pipeline that used the compromised components. Since Trivy is commonly integrated into CI/CD pipelines with access to container registries, cloud provider credentials, and deployment secrets, the malicious code had access to a broad range of sensitive data across thousands of affected organizations. The attack represents a sophisticated supply chain compromise targeting the software development lifecycle. Learn more about Embedded Malicious Code (CWE-506)
Impact Analysis
CVE-2026-33634 carries a CVSS 3.1 base score of 8.8 (HIGH), reflecting severe impact on organizations that consumed the compromised packages.
Confidentiality (High): The malicious code embedded in Trivy v0.69.4, trivy-action, and setup-trivy was specifically designed to exfiltrate secrets from CI/CD environments. This includes cloud provider credentials (AWS, GCP, Azure), container registry tokens, deployment keys, API keys, database connection strings, and any other secrets available as environment variables or in the CI/CD runner's filesystem. The scope of credential theft depends on the CI/CD pipeline configuration but typically includes access to production infrastructure.
Integrity (High): With stolen CI/CD credentials, the attacker can modify build artifacts, inject additional backdoors into container images, alter deployment configurations, and compromise the software supply chain downstream. The integrity impact extends beyond the immediate victim to their customers and users who may receive compromised software artifacts built by the affected pipelines.
Availability (High): The attacker can use stolen credentials to disrupt production services, delete infrastructure resources, or hold environments hostage. Additionally, the incident response required (credential rotation, pipeline rebuilds, artifact verification) causes significant operational disruption.
Scope (Unchanged): The CVSS scope is technically unchanged, but the real-world impact extends across the entire software supply chain. Organizations that ran the compromised Trivy in their CI/CD pipelines must assume that all credentials accessible to those pipelines are compromised, creating a cascading impact across cloud infrastructure, container registries, and downstream services. The EPSS score of 20.839% (95.6th percentile) reflects the extremely high exploitation rate.
Exploit Maturity
Active Exploitation: CVE-2026-33634 is a confirmed supply chain attack — exploitation is inherent in the vulnerability itself. Every organization that pulled and used Trivy v0.69.4, trivy-action with compromised tags, or setup-trivy < 0.2.6 between March 19, 2026 and the disclosure date was actively exploited. CISA added it to the KEV catalog on March 26, 2026, with a remediation deadline of April 9, 2026.
Ransomware Association: The CISA KEV catalog does not associate CVE-2026-33634 with known ransomware campaigns. However, the stolen CI/CD credentials could enable follow-on attacks including ransomware deployment against production environments accessible via the exfiltrated secrets.
Attack Timeline: The supply chain attack is a continuation of a broader campaign from late February 2026. On March 19, 2026, the threat actor used compromised credentials to publish malicious releases across multiple Trivy components simultaneously. The coordinated nature of the attack — targeting the binary release, the GitHub Action, and the setup action — indicates a sophisticated adversary with detailed knowledge of the Trivy ecosystem.
EPSS Context: The EPSS score of 20.839% (95.6th percentile) is among the highest observed, reflecting the massive scale of exploitation. Trivy is one of the most popular container security scanners, integrated into thousands of CI/CD pipelines globally. The automated nature of supply chain attacks means exploitation occurs passively whenever an affected pipeline runs.
Related Compromises: The same campaign also affected litellm versions 1.82.7-1.82.8 and telnyx versions 4.87.1-4.87.2, indicating a broader supply chain attack campaign targeting multiple open-source projects. See GHSA-69fq-xp46-6x23 for details.
Remediation
-
Immediately stop using compromised versions. Pin Trivy to a verified clean version (not 0.69.4). Update trivy-action to >= 0.35.0 and setup-trivy to >= 0.2.6. Verify the integrity of all Trivy-related components by checking commit hashes against the official Aquasecurity security advisory and GHSA-69fq-xp46-6x23.
-
Rotate ALL credentials accessible to affected CI/CD pipelines. This is the most critical remediation step. Identify every secret, API key, token, and credential that was available as an environment variable or accessible to CI/CD runners that executed the compromised Trivy. Rotate all of them immediately, including cloud provider credentials, container registry tokens, deployment keys, database passwords, and third-party API keys.
-
Audit CI/CD pipeline execution logs. Review pipeline logs for the period between March 19, 2026 and the date you updated to clean versions. Look for unexpected network connections, unusual environment variable access patterns, or modified build artifacts. Check container registry logs for unauthorized image pushes.
-
Verify integrity of build artifacts. Any container images, binaries, or packages built by pipelines that ran the compromised Trivy should be considered potentially tampered. Rebuild and re-deploy clean versions from trusted sources. Verify checksums of all artifacts built during the compromise window.
-
Implement supply chain security controls. Pin all GitHub Actions to specific commit SHAs (not tags, which can be force-pushed). Enable Dependabot or Renovate with digest pinning. Implement SLSA provenance verification for critical dependencies. Use GitHub's commit signing verification to detect force-pushed tags. Consider using a dependency proxy or private registry that caches verified versions.
Technical Details
CVE-2026-33634 is a supply chain attack (CWE-506: Embedded Malicious Code) targeting the Aquasecurity Trivy ecosystem, a widely-used open-source vulnerability scanner for containers, filesystems, and infrastructure-as-code.
CVSS 3.1 Vector Breakdown: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8 HIGH)
- Attack Vector (Network): The compromised packages are distributed over the network via GitHub releases and container registries.
- Attack Complexity (Low): No special conditions required — any pipeline using the compromised versions is automatically exploited.
- Privileges Required (Low): The attacker needed compromised maintainer credentials to publish the malicious releases, and victims need repository access to pull the packages.
- User Interaction (None): No user interaction needed — the malicious code executes automatically when the compromised Trivy is invoked in a CI/CD pipeline.
- Scope (Unchanged): The impact is contained within the CI/CD environment's security boundary.
- Impact (C:H/I:H/A:H): Full compromise of confidentiality, integrity, and availability of CI/CD secrets and downstream systems.
Attack Mechanics:
The threat actor executed a coordinated supply chain attack on March 19, 2026:
-
Trivy binary (v0.69.4): A malicious release was published to GitHub releases containing modified Trivy binaries that exfiltrate environment variables and secrets to attacker-controlled infrastructure before performing normal scanning operations.
-
trivy-action (< 0.35.0): Tags in the GitHub Action repository were force-pushed to point to commits containing credential-stealing malware. Any workflow referencing
aquasecurity/[email protected]by tag would pull the malicious code. -
setup-trivy (< 0.2.6): Tags were replaced with malicious commits that download and execute the compromised Trivy binary, ensuring the malware propagates regardless of which entry point the victim uses.
Exfiltration Targets: The malicious code specifically targeted CI/CD environment variables commonly containing secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, DOCKER_PASSWORD, KUBECONFIG, and similar credential-bearing variables. The collected data was exfiltrated to attacker-controlled endpoints.
Broader Campaign: This attack is connected to a broader supply chain campaign from late February 2026 that also compromised litellm (versions 1.82.7-1.82.8) and telnyx (versions 4.87.1-4.87.2), suggesting a coordinated effort targeting popular open-source packages.
Frequently Asked Questions
What is CVE-2026-33634?
CVE-2026-33634 is a supply chain attack affecting Aquasecurity Trivy, a popular open-source vulnerability scanner. On March 19, 2026, a threat actor used compromised credentials to publish malicious versions of Trivy (v0.69.4), trivy-action, and setup-trivy. The malicious code was designed to steal CI/CD secrets and credentials from every pipeline that used the compromised components. It is part of a broader supply chain attack campaign that also affected litellm and telnyx packages.
How do I know if I was affected by CVE-2026-33634?
You were affected if your CI/CD pipelines used any of the following between March 19, 2026 and when you became aware: Trivy v0.69.4, trivy-action before v0.35.0 (if pulled after the tag was force-pushed), or setup-trivy before v0.2.6. Check your pipeline definitions, dependency lock files, and CI/CD execution logs for these versions. Also check for litellm 1.82.7-1.82.8 and telnyx 4.87.1-4.87.2 if you use those packages.
What should I do if I used the compromised Trivy version?
Immediately update to clean versions (trivy-action >= 0.35.0, setup-trivy >= 0.2.6, avoid trivy 0.69.4). Then rotate ALL credentials that were accessible to affected CI/CD pipelines — this includes cloud provider keys, container registry tokens, deployment keys, and API keys. Audit pipeline logs for the compromise window and rebuild any artifacts produced during that period. See GHSA-69fq-xp46-6x23 for complete details.
How can I prevent supply chain attacks like CVE-2026-33634?
Pin GitHub Actions to specific commit SHAs instead of tags (tags can be force-pushed). Use dependency lock files with hash verification. Implement SLSA provenance checks for critical dependencies. Use a dependency proxy or private registry that caches verified versions. Enable branch protection and require signed commits on repositories you control. Monitor for unexpected version changes in your dependencies using tools like Dependabot or Renovate with digest pinning.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.