CVE-2026-33634

Overview

CVE-2026-33634 is a supply chain compromise affecting the Aquasecurity Trivy security scanner ecosystem. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. The attack also extended to the PyPI packages litellm (versions 1.82.7–1.82.8) and telnyx (versions 4.87.1–4.87.2). The flaw is classified as CWE-506: Embedded Malicious Code.

Supply Chain Attack: Continuation of February 2026 Compromise

This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic — not all credentials were revoked simultaneously. The attacker could have used a still-valid token to exfiltrate newly rotated secrets during the rotation window (which lasted several days), allowing them to retain access and execute the March 19 attack.

What the Malicious Code Did

• Process memory dumping: Dumped Runner.Worker process memory via /proc/<pid>/mem to extract CI/CD secrets.
• Credential harvesting: Swept 50+ filesystem paths for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, .env files, database credentials, and cryptocurrency wallets.
• Encrypted exfiltration: Encrypted collected data using AES-256-CBC with RSA-4096 hybrid encryption and transmitted to attacker-controlled infrastructure.
• Fallback exfiltration: If direct exfiltration failed and INPUT_GITHUB_PAT was set, created a public tpcp-docs repository on the victim's GitHub account and uploaded stolen data as a release asset.

Exposure Window

Affected Components

Aquasecurity Trivy Ecosystem

Other Affected Packages (PyPI)

Distribution Channels Compromised

Not Affected

Attack Details

Trivy v0.69.4 Binary & Container Images

1. Pushed a commit (1885610c) that swapped the actions/checkout reference to an imposter commit (70379aad) containing a composite action that downloaded malicious Go source files from a typosquatted domain.
2. Added --skip=validate to goreleaser to bypass binary validation.
3. Tagged this commit as v0.69.4, triggering the release pipeline.

The compromised release was distributed across all regular channels: GHCR, ECR Public, Docker Hub (both 0.69.4 and latest tags), deb/rpm packages, and get.trivy.dev.

trivy-action Tag Hijacking

The attacker force-pushed 76 of 77 version tags to malicious commits that injected an infostealer into entrypoint.sh. The malicious code executed before the legitimate Trivy scan, dumping process memory and sweeping 50+ filesystem paths for credentials.

setup-trivy Release Replacement

All 7 existing tags (v0.2.0 – v0.2.6) were force-pushed to malicious commits. The malicious action.yaml contained the same infostealer, injected as a "Setup environment" step. Remediated within ~4 hours; v0.2.6 was re-created with safe content.

Docker Hub Images (March 22)

Three days after the initial attack, the attacker created aquasec/trivy:0.69.5 and aquasec/trivy:0.69.6 with the same C2 payload, pushed directly to Docker Hub using separately-compromised Docker Hub credentials (not via GitHub).

Indicators of Compromise

Network

GitHub Exfiltration Artifacts

Impact

Mitigation & Remediation

Known-Safe Versions

Recommended Actions

1. Update to known-safe versions listed above immediately.
2. Rotate ALL secrets — if there is any possibility a compromised version ran in your environment, treat all secrets accessible to affected pipelines as exposed and rotate immediately. This includes cloud credentials, SSH keys, API tokens, database passwords, and service account keys.
3. Audit Trivy versions — check whether your organization pulled or executed Trivy v0.69.4 (or v0.69.5/v0.69.6 Docker images) from any source. Remove affected artifacts.
4. Audit GitHub Action references — review all workflows using aquasecurity/trivy-action or aquasecurity/setup-trivy. Check workflow run logs from March 19–20, 2026 for signs of compromise.
5. Search for exfiltration artifacts — look for repositories named tpcp-docs in your GitHub organization.
6. Pin GitHub Actions to full SHA hashes — never use mutable version tags. Use immutable commit SHA references as described in GitHub's security guidance.
7. Verify binary integrity — use cosign to verify sigstore signatures on Trivy binaries and container images. Safe versions were signed on March 1, before the March 19 attack.