Trivy ecosystem supply chain briefly compromised (CVE-2026-33634)

What is affected, what to do

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits.

The vulnerability is being actively exploited; treat it as a priority. Update Aquasecurity Setup-trivy to version 0.2.6, Aquasecurity Trivy-action to version 0.35.0. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Aquasecurity Setup-trivy lt *..0.2.6
• Aquasecurity Trivy-action lt *..0.35.0
• Aquasecurity Trivy eq 0.69.4..0.69.4
• BerriAI LiteLLM gte 1.82.7, <= 1.82.8..*
• Team-telnyx Telnyx gte 4.87.1, <= 4.87.2..*

Fixed in

• Aquasecurity Setup-trivy 0.2.6
• Aquasecurity Trivy-action 0.35.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Scope the blast radius: Search every repository in your GitHub org for aquasecurity/trivy-action and aquasecurity/setup-trivy, e.g. gh search code "aquasecurity/trivy-action" --owner <org> or grep -rE "aquasecurity/(trivy-action|setup-trivy)@" .github/workflows/. Any reference to a version tag rather than a full commit SHA counts as potentially compromised if the workflow ran on 19–20 March 2026.
   • Treat secrets as exposed and rotate them atomically: This applies to every pipeline that may have run Trivy v0.69.4, trivy-action 0.0.1–0.34.2, or setup-trivy 0.2.0–0.2.6 (before 0.2.6 was recreated). Revoke and reissue all reachable secrets: GitHub PATs and App keys, AWS/Azure/GCP credentials, SSH keys, registry tokens, database passwords and signing keys. Revoke everything first, then reissue. The vendor's own non-atomic rotation is what let the attacker back in.
   • Check for the exfiltration artefact: Look for any repository named tpcp-docs in your GitHub org. Its presence indicates the fallback exfiltration path fired and secrets were successfully stolen. If you find one, declare an incident and start the NIS2 early-warning clock (24 h).
   • Purge malicious artefacts: Remove Trivy v0.69.4 (Go binary and container image) from internal registries, artefact proxies (Artifactory/Nexus), runner caches and base images. Move to the known-safe versions: Trivy 0.69.2 or 0.69.3, trivy-action 0.35.0, setup-trivy 0.2.6 (recreated). Pin each one by full commit SHA or image digest.
   • Check downstream packages: The context lists BerriAI LiteLLM 1.82.7/1.82.8 and telnyx 4.87.1/4.87.2 as affected. Search lockfiles, SBOMs and package mirrors for these versions. Remove any hits and treat the environments that ran them as compromised runners. Look up the fixed versions in the vendor advisory.
   • Rebuild self-hosted runners: Do not try to clean persistent runners that executed affected versions. Redeploy them from a trusted image.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration / supply chain: Reference GitHub Actions only by 40-character commit SHA (uses: aquasecurity/trivy-action@<sha> # v0.35.0). At org level, restrict "Allowed actions" to an allowlist of pinned SHAs. Enforce pinning in PR gates with tools such as zizmor or the OpenSSF Scorecard "Pinned-Dependencies" check.
   • IAM / least privilege: Replace long-lived cloud secrets in CI with OIDC federation and short-lived tokens, scoped to a specific repo and branch. Set GITHUB_TOKEN to contents: read by default via permissions:. Never expose deploy secrets to security-scan jobs.
   • Network segmentation: Put CI runners behind an egress allowlist covering package registries, the GitHub API and your own registry. On GitHub-hosted runners, use an egress filter such as Harden-Runner in block mode. On self-hosted runners, enforce a default-deny proxy on the runner VLAN.
   • Artefact integrity: Pull Trivy binaries and images only through an internal mirror with digest pinning (aquasec/trivy@sha256:...). Verify signatures or checksums before promotion, and disable auto-updates to "latest" for security tooling.
   • Runner hardening: Use ephemeral runners (one job per VM or container). Block cross-process memory access with kernel.yama.ptrace_scope=2 and run containers without CAP_SYS_PTRACE, which makes it harder to scrape secrets from runner process memory.
3. 03

   Runbook step 3

   Detection rules

   • GitHub audit log: Hunt for repo.create events matching tpcp-docs, any unexpected repository creation by service accounts or PATs, and token use from unfamiliar IP ranges since 1 March 2026. KQL shape: GitHubAuditLog | where Action == "repo.create" and Repository has "tpcp-docs".
   • Workflow run logs, 19–20 March 2026: Export logs for jobs that used trivy-action or setup-trivy. Look for unexpected curl/wget calls, base64 blobs, reads of /proc/*/mem or /proc/*/environ, abnormally long scan-step durations, or a downloaded Trivy version 0.69.4.
   • auditd / Sysmon for Linux on self-hosted runners: Watch for reads of runner process memory, e.g. -a always,exit -F arch=b64 -S open,openat -F dir=/proc -F success=1 -k proc_mem, filtered on mem/environ. Alert when the accessing process is trivy or a non-build-tool child of Runner.Worker.
   • Network telemetry (Zeek/Suricata/proxy): Flag outbound connections from runner subnets to destinations outside the egress allowlist. Prioritise DNS queries or TLS SNI for newly registered domains, and large POST bodies shortly after Trivy starts. SPL shape: index=proxy src_zone=ci_runners NOT dest_domain IN (allowlist) | stats sum(bytes_out) by src_ip, dest_domain.
   • Registry / SBOM inventory: Check registry and proxy pull logs for aquasec/trivy:0.69.4 and trivy_0.69.4_*. Scan SBOMs and lockfiles for litellm==1.82.7|1.82.8 and telnyx==4.87.1|4.87.2.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

Source: OSV (Open Source Vulnerabilities), cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Aquasec Trivy
• Aquasecurity Trivy
• BerriAI BerriAI LiteLLM
• Go Github.com/aquasecurity/trivy
• LiteLLM LiteLLM

Weakness classes (CWE)

• CWE-506Embedded Malicious Code

  Class

  The product contains code that appears to be malicious in nature.

  Entry at MITRE CWE-506

References & sources

• github.comaquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23advisory, x_refsource_CONFIRM, Exploit, Mitigation, Vendor advisory
• docs.litellm.aiblog/security-update-march-2026web, x_refsource_MISC, Third-party advisory
• futuresearch.aiblog/litellm-pypi-supply-chain-attackweb, x_refsource_MISC, Third-party advisory
• github.comBerriAI/litellm/issues/24518web, x_refsource_MISC, Issue tracking, Mitigation, Third-party advisory
• github.comBerriAI/litellm/issues/24518web, Third-party advisory, Issue tracking, Mitigation, Third-party advisory
• github.comaquasecurity/trivy/discussions/10425web, x_refsource_MISC, Issue tracking, Vendor advisory
• github.compypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yamlweb, x_refsource_MISC, Third-party advisory
• github.comteam-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33…web, x_refsource_MISC, Third-party advisory
• inspector.pypi.ioproject/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f…web, x_refsource_MISC, Broken link
• inspector.pypi.ioproject/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36f…web, x_refsource_MISC, Broken link
• rosesecurity.dev2026/03/20/typosquatting-trivy.htmlweb, Exploit, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33634web, government-resource, US government resource
• microsoft.comen-us/security/blog/2026/03/24/detecting-investigating-defendin…web
• wiz.ioblog/teampcp-attack-kics-github-actionweb, x_refsource_MISC, Not applicable
• microsoft.comen-us/security/blog/2026/03/24/detecting-investigating-defendin…Third-party advisory, Technical description
• NVD (NIST)vuln/detail/CVE-2026-33634advisory
• github.comaquasecurity/trivypackage