Trivy supply chain compromise via malicious release and retagged GitHub Actions
CVE-2026-33634 tracks a software supply chain compromise affecting Aqua Security's Trivy distribution infrastructure. On 2026-03-19, a threat actor using compromised credentials published a malicious Trivy v0.69.4 release and force-pushed 76 of 77 version tags in aquasecurity/trivy-action plus all 7 tags in aquasecurity/setup-trivy to attacker-controlled commits containing credential-stealing malware. The incident was described as a continuation of an earlier compromise from late February 2026, where incomplete, non-atomic credential rotation may have allowed the attacker to retain access. The malicious artifacts abused trust in official release channels and mutable GitHub Action tags so that workflows resolving tags rather than immutable commit SHAs could execute attacker code. Affected components include the aquasecurity/trivy Go binary and container image version 0.69.4, aquasecurity/trivy-action versions 0.0.1 through 0.34.2, and aquasecurity/setup-trivy versions 0.2.0 through 0.2.6 prior to recreation of 0.2.6 with a safe commit.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
tpcp-docs, which may indicate fallback exfiltration. Limit secret exposure in CI/CD runners, reduce token scope, and ensure future credential rotations are atomic so old and new credentials cannot overlap. Monitor for unauthorized artifact pulls or executions of Trivy v0.69.4 and for suspicious activity in repositories that consumed affected tags during the exposure window.Remediation
Patch, then assume compromise.
aquasecurity/trivy-action 0.35.0, and aquasecurity/setup-trivy 0.2.6 only after its safe recreation. Remove any affected artifacts immediately and verify whether Trivy v0.69.4 was pulled or executed from any source. Review workflows using aquasecurity/trivy-action or aquasecurity/setup-trivy, especially runs from 2026-03-19 through 2026-03-20 if version tags rather than full commit SHAs were referenced. If compromised versions may have run, treat all secrets accessible to those pipelines as exposed and rotate them immediately.Exploits
No valid public exploits. Mallory filtered out 4 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
92 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability tracked in CISA KEV and associated in this reporting with the broader TeamPCP campaign context; the content does not describe the technical flaw itself.
A specific vulnerability tracked in CISA KEV and associated in this report with the broader TeamPCP campaign context, but the content does not describe the technical nature of the flaw.
A specific vulnerability tracked in CISA KEV and associated in this reporting with the broader TeamPCP campaign context; the content does not describe the technical flaw itself.
A supply chain compromise of Aqua Security's Trivy distribution infrastructure in which malicious code and weaponized binaries were pushed across official Trivy delivery channels, enabling theft of CI/CD secrets and downstream compromise at scale.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.