CVE-2026-33634

Name of the Vulnerable Software and Affected Versions aquasecurity/trivy version 0.69.4 aquasecurity/trivy-action versions 0.0.1 through 0.34.2 aquasecurity/setup-trivy versions 0.2.0 through 0.2.6

Description A supply chain attack targeted the Trivy security scanner, where a threat actor used compromised credentials to distribute malicious versions of the software. The attacker published a malicious release of the Trivy binary and container image, and performed force-pushes to overwrite version tags for the aquasecurity/trivy-action and aquasecurity/setup-trivy GitHub Actions. The malicious code functions as an infostealer that executes before the legitimate scan to dump process memory via /proc/<pid>/mem and harvest sensitive data, including SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configurations, .env files, and cryptocurrency wallets. Stolen data is encrypted using AES-256-CBC and RSA-4096 before being exfiltrated to attacker-controlled infrastructure. If primary exfiltration fails, the malware may create a public repository named tpcp-docs in the victim's GitHub organization to upload the stolen secrets. This campaign is estimated to have affected over 10,000 CI/CD pipelines and 1,000+ SaaS environments, resulting in the theft of over 500,000 credentials. A notable incident involved the breach of the European Commission's Europa platform on AWS.

Recommendations Update aquasecurity/trivy to version 0.69.2 or 0.69.3. Update aquasecurity/trivy-action to version 0.35.0. Update aquasecurity/setup-trivy to version 0.2.6. Immediately rotate all secrets, tokens, and credentials accessible to any pipeline where a compromised version was executed. Remove all affected artifacts and binaries of version 0.69.4 from all environments. Pin GitHub Actions to full, immutable commit SHA hashes instead of using mutable version tags. Review workflow run logs from March 19–20, 2026, for any signs of compromise, especially for workflows referencing version tags. Check GitHub organizations for the presence of a repository named tpcp-docs, which indicates successful secret exfiltration.