CVE-2026-33634

The attacker gained access to a valid GitHub token during the credential rotation window (lasting several days after the initial incident on March 1, 2026) because the rotation was not atomic — not all credentials were invalidated simultaneously. This allowed him to publish a malicious Trivy v0.69.4 release, overwrite 76 of 77 version tags in `aquasecurity/trivy-action` (versions 0.0.1–0.34.2) and replace all 7 tags in `aquasecurity/setup-trivy` (versions 0.2.0–0.2.6) with malicious commits containing malware. The malicious code aimed to exfiltrate secrets available in the CI/CD environment; as a fallback mechanism, a repository named `tpcp-docs` is created in the victim's organization. The vulnerability is classified as CWE-506 (Embedded Malicious Code), confirming that the attacker embedded malicious code directly in legitimately-looking artifacts.

The attacker can steal all secrets (tokens, API keys, passwords) available in CI/CD pipelines using infected components, enabling further lateral movement in the organization's infrastructure and takeover of other systems and repositories.

Immediately update to known secure versions: Trivy binary 0.69.2 or 0.69.3, trivy-action 0.35.0, setup-trivy 0.2.6 (restored with secure commit). All secrets available in pipelines where the infected version may have run should be treated as compromised and immediately rotated. Verify whether your organization downloaded or ran Trivy v0.69.4 from any source, remove all affected artifacts, and review workflow logs from March 19–20, 2026. Look for repositories named `tpcp-docs` in your GitHub organization — their presence may indicate successful secret exfiltration. Going forward: pin GitHub Actions to full, immutable commit SHA hashes instead of mutable version tags.

Aquasecurity Trivy version 0.69.4 (Go binary and container); Aquasecurity trivy-action versions 0.0.1–0.34.2 (76 of 77 tags); Aquasecurity setup-trivy versions 0.2.0–0.2.6 (prior to restoration of secure commit 0.2.6). CI/CD pipelines using LiteLLM that used the mentioned actions are also affected.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.