CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
Overview
A supply chain attack against Aquasecurity Trivy replaced legitimate release artifacts with credential-stealing malware. A threat actor used compromised Aquasecurity publishing credentials to publish a malicious Trivy binary (v0.69.4), force-push 76 of 77 version tags in the trivy-action GitHub Action, and replace all 7 tags in setup-trivy with malicious commits. Any CI/CD pipeline that pulled these poisoned artifacts during the exposure window on March 19-20, 2026 silently executed the attacker's code, exposing every secret accessible to that pipeline.
Vulnerability details
This vulnerability is classified as embedded malicious code (CWE-506): legitimate software distribution channels were used to deliver artifacts containing attacker-controlled payloads. The attacker exploited Git's mutable tag model, reassigning existing trusted version tags to commits containing malicious entrypoint logic. Because the malicious code executed before the legitimate Trivy scan and produced normal scan output, pipelines appeared to function correctly. The Trivy binary was similarly poisoned by swapping an upstream dependency reference to a typosquatted domain that served malicious Go source files, which were then compiled and distributed through official channels including GitHub Releases, GHCR, ECR Public, and Docker Hub.
The attacker gained access by using compromised Aquasecurity service-account credentials retained from an incompletely remediated incident in late February 2026. Pipelines that referenced affected components by mutable version tag (rather than immutable commit SHA) and executed during the exposure window ran the malicious payload. That payload first harvested environment variables from GitHub Actions runner processes via /proc/PID/environ, then swept more than 50 filesystem paths for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, .env files, and database passwords. Collected data was encrypted with AES-256-CBC and RSA-4096 hybrid encryption before exfiltration. The malware also attempted Kubernetes lateral movement and persistent backdoor installation where service account tokens were present.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Check workflow run logs from March 19-20, 2026 for any job that invoked trivy-action or setup-trivy; unexpected outbound HTTPS connections to domains outside normal CI/CD infrastructure during those runs indicate active exfiltration.
- Look for a repository named tpcp-docs in your GitHub organization. The vendor advisory states its presence may indicate the fallback exfiltration mechanism was triggered and secrets were successfully stolen.
- Audit runner process logs or container image pull records for use of Trivy v0.69.4 from any distribution channel (GitHub Releases, GHCR, ECR Public, Docker Hub, deb/rpm packages) during the March 19-20 exposure window.
- On Linux runners, inspect /tmp for files matching the pattern runner_collected_*.txt, which the malicious shell script used as a staging file for harvested environment variables and credential content.
Remediation
Additional hardening
- Upgrade trivy-action to 0.35.0 or later and setup-trivy to 0.2.6 (recreated safe version) or later; avoid Trivy binary v0.69.4 and use v0.69.3 or v0.69.2 instead. See References for the vendor advisory covering all affected components.
- If any affected version ran in your environment, treat all secrets accessible to those pipelines as compromised: rotate GitHub tokens, SSH keys, AWS/GCP/Azure credentials, Kubernetes service account tokens, Docker configs, and database passwords immediately.
- Pin all GitHub Actions references to full, immutable commit SHA hashes rather than mutable version tags; mutable tags are the mechanism this attack exploited to redirect trusted references to malicious code without any visible change to consumers.
- Audit Kubernetes clusters accessible from affected runners for unauthorized pods in kube-system matching the pattern node-setup-* and check for persistence files at ~/.config/sysmon/sysmon.py and ~/.config/systemd/user/sysmon.service.
Key dates
References
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
- https://github.com/advisories/GHSA-69fq-xp46-6x23
- https://nvd.nist.gov/vuln/detail/CVE-2026-33634
- https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack
- https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html
- https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
- https://github.com/BerriAI/litellm/issues/24518
- https://github.com/aquasecurity/trivy/discussions/10425
Frequently asked questions
Does CVE-2026-33634 affect my FedRAMP authorization?
If Aquasecurity Trivy runs inside your authorization boundary, yes. CVE-2026-33634 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of April 9, 2026 has already passed. For a Federal Risk and Authorization Management Program (FedRAMP)-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your path forward is either to remediate immediately or to formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-33634?
Knox does not patch your software. Remediating Aquasecurity Trivy is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation of the fix for your next assessment. Applying the fix is yours to own; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-33634 surfaces, exposure appears through ongoing monitoring rather than waiting for an assessor to flag it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-33634's remediation deadline of April 9, 2026 has passed. What happens now?
If CVE-2026-33634 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and formally documenting why the deadline was missed is what keeps your authorization intact and the agency relationship in good standing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
