CVE-2026-33634

Trivy ecosystem supply chain briefly compromised

Exploited in the wild. In CISA KEV since 2026‑03‑26. A vendor fix is available.

CVSS 3.18.8High EPSS percentile99th60% chance in 30 days CISA KEVListedsince 2026-03-26, due 2026-04-09
No public exploit known FixVendor fixNo build named by the sources

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.125882

Run the check

Published 2026-03-23Updated 2026-03-30Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Aquasecurity Setup-trivyAffected: < 0.2.6Upgrade to: not statedStated by: CVE record
Aquasecurity Trivy-actionAffected: < 0.35.0Upgrade to: not statedStated by: CVE record
Aquasecurity TrivyAffected: = 0.69.4Upgrade to: not statedStated by: CVE record
BerriAI LiteLLMAffected: >= 1.82.7, <= 1.82.8Upgrade to: not statedStated by: CVE record
Team-telnyx TelnyxAffected: >= 4.87.1, <= 4.87.2Upgrade to: not statedStated by: CVE record

Versions as the sources state them. 6 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your CI/CD workflows or scripts used the affected versions: trivy v0.69.4, trivy-action 0.0.1–0.34.2, or setup-trivy 0.2.0–0.2.6 (especially if you used version tags rather than full commit SHAs).
If you used any of those versions, immediately rotate credentials that were available to those pipelines (API keys, registry tokens, cloud credentials, and any CI secrets) because they must be treated as exposed.
Update to the fixed versions: setup-trivy 0.2.6, trivy action 0.35.0, and avoid using the affected trivy v0.69.4 (use the known safe 0.69.2/0.69.3).
Re-check recent pipeline runs around 2026-03-19 to 2026-03-20 for signs of compromise, and remove any suspect build artifacts that may contain tampered scanner outputs.
Review your workflows to pin GitHub Actions to immutable commit SHAs (not mutable version tags) for any Trivy-related actions you use.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Malicious LiteLLM releases linked to TeamPCP supply chain attack exposed secrets from over 2,100 organizations via credential-stealing code.
as reported · Aug 12, 2026·The Hacker News summary
Added to CISA KEV catalog
Mar 26, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

In plain language

Written by AI from the record

Trivy’s update mechanism was briefly compromised, so some common security-scanner versions could have been turned into credential-stealers; if you used those specific versions (especially in GitHub Actions/CI), you should act now.

CVE-2026-33634 is a supply-chain compromise (CWE-506) where attackers gained unauthorized access to Trivy’s infrastructure and published malicious Trivy ecosystem updates through GitHub Actions and container image releases, enabling credential theft from CI/CD environments running affected versions.

If you're affected

CI/CD secrets stolen
Unauthorized access to internal systems
Malicious code execution in pipelines
Service disruption from compromised builds

What is it

Trivy is a security scanner. In this incident, the “updates” you download for Trivy (and the GitHub Actions that help set it up) were briefly replaced with something malicious.

Think of it like downloading a fire extinguisher that was swapped with one that steals your building’s access codes while it’s being “installed.” If your pipelines used the affected versions, your CI secrets may have been captured.

Who is affected

This matters if your organization runs Trivy security scanning using the affected products: setup-trivy, trivy, or trivy action, including where these are used inside GitHub Actions/CI pipelines.

It’s a risk when you used the vulnerable versions listed (or you used mutable version tags rather than pinned commit SHAs), since the compromise could be delivered through official channels; there’s no user interaction required in the way this attack operates.

How urgent is it

This is RED because real attackers were able to compromise the Trivy supply chain and CISA added it to KEV with a required remediation deadline. That means this isn’t a theoretical issue—your CI/CD secrets are the likely target if you used the affected versions.

Act immediately: treat secrets accessible to affected pipelines as exposed and upgrade to the fixed versions.

What to do — in detail

Confirm whether you are affected (fast checks)
- Search your repositories and CI/CD configs for usage of:
  - trivy v0.69.4
  - trivy-action versions 0.0.1–0.34.2
  - setup-trivy versions 0.2.0–0.2.6
- If you used version tags (instead of full, immutable commit SHAs), check workflow run logs specifically for 2026-03-19 through 2026-03-20 for unusual behavior.
If any affected version was used, treat secrets as compromised
- Rotate all credentials accessible to those pipelines (CI/CD secrets, cloud credentials, API keys, registry tokens, and anything used by the job where Trivy ran).
- Assume secrets may have been exfiltrated during the credential rotation window noted in the incident.
Upgrade to fixed components
- Update setup-trivy to fixed version 0.2.6.
- Update trivy action to fixed version 0.35.0.
- For the Trivy binary itself, do not use 0.69.4; use the known safe 0.69.2 or 0.69.3.
Remove/contain potential tampered artifacts
- Remove any artifacts that may have been produced with the compromised scanner execution.
Pin GitHub Actions to immutable commit SHAs
- Update workflows so Trivy-related actions are pinned to full commit SHA hashes rather than mutable tags.
Additional indicators to look for
- Review for presence of repositories named tpcp-docs in your GitHub organization as an indicator of exfiltration behavior.
Timing and deadline
- CISA KEV lists the required remediation deadline as 2026-04-09.
Ongoing monitoring after remediation
- Review CI/CD logs for unexpected outbound network activity, unusual requests, or credential-related errors around the affected time window.
- Confirm new pipeline runs succeed with the fixed versions and that secrets were successfully rotated.

Technical context

Severity and status: High severity (CVSS 8.8) with confirmed supply-chain compromise and inclusion in CISA KEV (added 2026-03-26), with remediation due 2026-04-09. The reporting indicates sustained incident attention.

Mechanism (weakness/trigger): CWE-506. Attackers gained unauthorized access to Trivy’s infrastructure and published malicious updates through official distribution paths (GitHub Actions and container image releases). In CI/CD, the malicious update could steal credentials available to pipelines.

Affected software and exposure window (from findings): vulnerable versions include Trivy v0.69.4, trivy-action 0.0.1–0.34.2 (76 of 77 tags), and setup-trivy 0.2.0–0.2.6. The risk is highest when workflows used these versions via mutable tags rather than pinned commit SHAs.

Exploitation maturity: No public exploit code is recorded, but exploitation is confirmed via KEV listing, which takes precedence over predictive likelihood.

KEV meaning here: KEV indicates CISA has validated the vulnerability as actively relevant and requires coordinated mitigations per their guidance.

EPSS: Provided in the findings but not used as a driver for action due to KEV confirmation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-03-26.

US federal agencies must remediate by 2026-04-09.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

60% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

14 events over 216 days, from the signal feeds we watch.

2026-10-25EPSS band change0 → highepss band change
2026-10-05EPSS band changehigh → low
2026-09-30EPSS band changehigh → low
2026-09-24EPSS band changehigh → 0epss band change
2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → high

Affected products

aquaseccommercial
Aqua Security Software Ltd.commercialaka aqua security
aquasecuritycommercial · USaka trivy, trivy-action, setup-trivy
LiteLLMoss-project
- LiteLLMMixedAI / ML / llm-serving-inference
telnyxcommercial
- telnyxMixedCommunications
BerriAIcommercialaka litellm, berriai/litellm
- LiteLLMSaaSAI / ML / llm-serving-inference

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-506No name in the record

Sources

References in the record

And 14 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Setup-trivy, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account