EUVD-2026-14601
GHSA-69fq-xp46-6x23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid credentials from previous compromise
-
ExploitPublish malicious Trivy release
-
ExecutionForce-push malicious commits to action repositories
-
ImpactDistribute credential-stealing malware via supply chain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Code review, malicious code detection
|
| Exploitation Conditions | Requires pull of compromised Trivy v0.69.4 release, or use of malicious |
| Impact | Extreme risk. Trivy is embedded in thousands of CI/CD pipelines worldwide. Any organization running Trivy actions during the compromise window had their CI/CD secrets potentially exfiltrated. This mirrors the tj-actions/changed-files incident pattern. |
| Exploit ScenarioDerived | Organizations with GitHub Actions workflows referencing trivy-action@v1 through @v45 automatically pulled the malicious code on their next pipeline run. The compromised action exfiltrated all available secrets and environment variables to attacker-controlled infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
Trivy security scanner v0.69.4 was compromised in a supply chain attack where a threat actor used stolen credentials to publish malicious releases and force-push credential-stealing malware to GitHub Actions repositories.
Earlier versions of this analysis (1)
On March 19, 2026, a threat actor compromised Trivy, a widely-used security scanner, by publishing a malicious v0.69.4 release, force-pushing 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replacing all 7 tags in aquasecurity/setup-trivy.
RemediationAI
Pin all GitHub Actions to specific commit SHAs rather than mutable tags. Rotate ALL secrets that were available to CI/CD pipelines during the compromise window. Audit pipeline logs for unauthorized outbound connections. Use GitHub's allow-listed actions feature.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-506 supply chain attack used compromised credentials to inject malicious code into trusted CI/CD components. The malware harvested secrets from GitHub Actions runners, including API keys, cloud credentials, and tokens stored in environment variables.
Know when Trivy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the aquasecurity/trivy Go / Container image version 0.69.4, the aquasecurity/trivy-action GitHub Action versions 0.0.1 - 0.34.2 (76/77), and theaquasecurity/setup-trivy GitHub Action versions 0.2.0 - 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using aquasecurity/trivy-action or aquasecurity/setup-trivy. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19-20, 2026 for signs of compromise. Look for repositories named tpcp-docs in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.
Articles & Coverage 2
Executive ViewAI
Organizations using Trivy face critical risk from CVE-2026-33634 rated CVSS 9.4. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Arbitrary file write in Aqua Security's Trivy scanner (prior to 0.71.1) allows an attacker who can make Trivy fetch an a
Decompression bomb (zip bomb) in Trivy's Helm chart scanner causes denial of service via OOM kill when processing a craf
Arbitrary file write in Trivy's plugin manager prior to version 0.72.0 allows a malicious plugin author to escape the co
Trivy versions before 0.71.0 allow directory traversal through Terraform filesystem functions during misconfiguration sc
Same weakness CWE-506 – Embedded Malicious Code
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB