Supply Chain Vulnerability in Aqua Security Trivy and GitHub Actions

CVE-2026-33634

What is CVE-2026-33634?

CVE-2026-33634 is a high-severity supply chain vulnerability impacting Aqua Security's Trivy, a popular open-source security scanner used for container images and infrastructure as code. This vulnerability emerged when threat actors compromised credentials to publish a malicious release of Trivy (version 0.69.4) on March 19, 2026. The malicious release included credential-stealing malware within the GitHub Actions associated with Aqua Security, specifically aquasecurity/trivy-action and aquasecurity/setup-trivy. This security incident highlights a critical flaw in credential management, as the attacker was able to leverage valid tokens during a window created by a non-atomic credential rotation, allowing them to exfiltrate sensitive information as security measures were implemented. Organizations utilizing affected components face a substantial risk of data breaches, unauthorized access, and further exploitation if the vulnerability is not promptly addressed.

Potential impact of CVE-2026-33634

1. Credential Theft: The vulnerability allows attackers to compromise secret credentials during the rotation process, leading to the potential theft of sensitive information. This exfiltration can provide further access to organizational systems, amplifying the severity of the breach.

2. Malicious Code Execution: By disseminating a malicious version of Trivy, attackers can execute harmful code within environments using affected components. This could lead to malware installation or other nefarious actions that compromise the integrity and security of development and operational pipelines.

3. Supply Chain Compromise: Organizations reliant on Aqua Security's tools face a direct threat to their software supply chain integrity. The ability for an attacker to manipulate a widely used security tool raises concerns not only for the immediate victim but also for the broader community relying on the reliability of the infrastructure and security practices established by open-source projects.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References