Log in Request a demo

Significant cyber incident

Trivy scanner and GitHub Actions compromise

In short

In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing code. Anyone whose build pipeline ran them on 19 and 20 March 2026 had to treat its secrets as exposed. CISA listed the Trivy compromise as exploited.

Last updated 9 October 2026

What happened

On 19 March 2026 an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release. The attacker also moved 76 of the 77 version tags of the trivy-action GitHub Action, and all 7 tags of the setup-trivy action, to malicious code. On 22 March malicious Trivy v0.69.5 and v0.69.6 images appeared on Docker Hub.

Aqua Security, which maintains Trivy, says the attack continued one that began in late February 2026. Its first clean-up, after the 1 March disclosure, rotated credentials but not all at once, so the attacker may have kept access.

CISA added the issue, CVE-2026-33634, to its Known Exploited Vulnerabilities catalog on 26 March 2026. LiteLLM, a separate project, says it believes its own later compromise came from the Trivy dependency in its build scanning. See also the LiteLLM PyPI package compromise, which CERT-EU’s Cyber Brief of 1 April 2026 names in the same TeamPCP activity.

Timeline

  1. Late February 2026

    Aqua Security says an attack on the Trivy project begins.

  2. 2026-03-01

    Aqua discloses an incident in which credentials were stolen. Credential rotation is not done all at once.

  3. 2026-03-19

    First malicious activity seen at 17:43 UTC. Malicious Trivy v0.69.4, trivy-action tags and setup-trivy tags are published.

  4. 2026-03-19

    CERT-EU says an AWS key was obtained from the European Commission through the compromised Trivy.

  5. 2026-03-20

    Aqua posts its public incident discussion. The trivy-action exposure window ends at about 05:40 UTC.

  6. 2026-03-22

    Malicious Trivy v0.69.5 and v0.69.6 images appear on Docker Hub.

  7. 2026-03-23

    The CVE record for CVE-2026-33634 is published.

  8. 2026-03-24

    The European Commission security center sees alerts about odd Amazon API use. LiteLLM's bad PyPI versions are live for about 40 minutes.

  9. 2026-03-25

    The European Commission notifies CERT-EU.

  10. 2026-03-26

    CISA adds CVE-2026-33634 to its Known Exploited Vulnerabilities catalog. The German BSI and the Canadian Centre for Cyber Security issue warnings.

  11. 2026-03-27

    The European Commission publicly discloses its incident in a press release.

  12. 2026-03-28

    The group ShinyHunters publishes the stolen Commission data on its leak site.

  13. 2026-04-02

    CERT-EU publishes its blog post on the Commission breach.

How the attack worked

Step 1: access from an earlier breach

Aqua Security says the 19 March attack followed the late February and 1 March incident. Rotation of secrets after that incident was not atomic, so the attacker may have seen the new tokens.

Step 2: a poisoned release

The attacker pushed a commit that swapped the checkout step for a look-alike commit. That commit pulled malicious Go source files from a typosquatted domain. The result was Trivy v0.69.4, sent out through GitHub, container registries, deb and rpm packages, and get.trivy.dev. The malicious code was not on the main branch. This is Supply Chain Compromise: Compromise Software Supply Chain (T1195.002), as CERT-EU lists it.

Step 3: moved tags on the GitHub Actions

The attacker force-pushed 76 of 77 trivy-action tags and all 7 setup-trivy tags to malicious commits. Pipelines that referenced a tag, not a full commit hash, ran the stealer before the real scan.

Step 4: the stealer

The code searched more than 50 file paths for SSH keys, cloud credentials, Kubernetes tokens and Docker configs. It encrypted the data and sent it to attacker infrastructure. If that failed, it could upload the data as a release asset in a public repository on the victim’s own GitHub account.

Step 5: use of stolen keys

CERT-EU describes one case. An AWS key taken on 19 March was used to run TruffleHog, add a new access key to an existing user and take data. CERT-EU lists Compromise Accounts: Cloud Accounts (T1586.003), Valid Accounts: Cloud Accounts (T1078.004) and Data from Local System (T1005) for the case.

Impact

Aqua Security lists exposure windows: Trivy v0.69.4 for about 3 hours on 19 March, trivy-action for about 12 hours, setup-trivy for about 4 hours, and Docker Hub images 0.69.5 and 0.69.6 for about 10 hours from 22 March. Anyone whose pipeline ran them had to treat secrets as exposed. CISA says the issue is exploited. The German BSI says it received a number of compromise reports and that, as it knew then, no data had leaked in those cases. CERT-EU reports that about 91.7 GB of compressed data was taken from a European Commission cloud account, covering hosting clients including 42 Commission clients and at least 29 other EU entities. It confirmed personal data such as names and email addresses. The Commission said its internal systems were not affected. Number of other victims: not stated in the sources opened.

Government and regulator response

  • 2026-03-19 to 2026-03-22, Aqua Security: removed malicious releases within about four hours, restored safe tags, removed the Docker Hub tags and locked down automated actions and tokens. It advised updating to known safe versions, rotating secrets, pinning actions to full commit hashes and blocking the command and control domain and IP.
  • 2026-03-26, CISA: added CVE-2026-33634 to the Known Exploited Vulnerabilities catalog with a due date of 9 April 2026 for federal civilian agencies.
  • 2026-03-26, German BSI and Canadian Centre for Cyber Security: published warnings.
  • 2026-03-25 to 2026-04-02, European Commission and CERT-EU: the Commission disabled the stolen key and the new access keys, told data protection officers and the European Data Protection Supervisor, and from 31 March spoke with affected hosting clients. It published a press release on 27 March. CERT-EU published its blog post on 2 April.

Lessons

  1. Pin to a commit, not a tag

    Tags can be moved. 76 of 77 trivy-action tags were moved to malicious code, while the one release protected by GitHub immutable releases was not affected.

  2. Rotate secrets all at once

    Aqua says its first clean-up rotated credentials but not atomically, and the attacker may have used that gap to return on 19 March.

  3. A security tool is also a supply chain risk

    The scanner ran inside build pipelines with access to secrets, so a poisoned copy could reach many organizations.

  4. Secrets in pipelines are the real prize

    The stealer looked for SSH keys, cloud credentials and tokens, and one stolen AWS key led to a data breach at the European Commission.

  5. Bad updates arrive through normal channels

    CERT-EU says the Commission received the compromised Trivy through normal software update channels.

  6. One compromise feeds the next

    LiteLLM says it believes its own compromise came from the Trivy dependency in its build scanning.

What to check in your own organization

  1. Find the exposure

    Search build logs for runs of trivy-action or setup-trivy on 19 and 20 March 2026, and for Trivy v0.69.4, 0.69.5 or 0.69.6 on any host or registry.

  2. Pin by hash

    List every workflow that references an action by tag and change it to a full commit hash, as Aqua recommends.

  3. Rotate

    If a bad version ran, treat all secrets reachable by that pipeline as exposed and rotate them together, not one by one.

  4. Look for the fallback

    Search your GitHub organization for repositories named tpcp-docs, which Aqua says may show the fallback upload was used.

  5. Cloud key audit

    Review AWS access keys reachable from pipelines, and CloudTrail for odd token calls, new access keys on existing users and TruffleHog use, as CERT-EU advises.

  6. Network blocks

    Check proxy and DNS logs for the domain and IP address Aqua published as command and control.

  7. Early warning

    Threat intelligence monitoring can watch for your credentials appearing outside your control, for new alerts such as the CISA catalog entry on 26 March, and for named groups or compromised packages your pipelines use. It may have given earlier notice here, but there is no guarantee.

Questions

What is CVE-2026-33634?

It is the identifier for the Trivy supply chain compromise. CISA lists it as an embedded malicious code vulnerability in its Known Exploited Vulnerabilities catalog, added 26 March 2026.

Which versions are safe?

The CVE record lists Trivy 0.69.2 and 0.69.3, trivy-action 0.35.0 and setup-trivy 0.2.6.

Was the Trivy source code changed?

Aqua says the malicious code was not committed to the main branch. It was fetched and built on a temporary runner.

Who was behind it?

CERT-EU says the compromise was publicly attributed to TeamPCP by Aqua Security. The BSI says the group is said to be behind it.

How did it reach the European Commission?

CERT-EU says the Commission received the compromised Trivy through normal updates, and an AWS key was taken on 19 March.

How is LiteLLM linked?

LiteLLM says it believes its compromise originated from the Trivy dependency in its CI/CD scanning workflow.

In our research

  1. How a Trivy Compromise Reached LiteLLM Releases October 2026
  2. Nx Console and GitHub: dev tools as an entry path October 2026
  3. TanStack worm: CI questions every team should ask October 2026
  4. TeamPCP Threat group

Sources

  1. Trivy ecosystem supply chain temporarily compromised (GHSA-69fq-xp46-6x23) Aqua Security (aquasecurity/trivy on GitHub)
  2. Trivy Security incident 2026-03-19 (Discussion 10425) Aqua Security (aquasecurity/trivy on GitHub)
  3. CVE-2026-33634 record CVE Program (CVE Services API)
  4. CISA Adds One Known Exploited Vulnerability to Catalog CISA
  5. Known Exploited Vulnerabilities catalog (JSON feed) CISA
  6. Aqua Security security advisory (AV26-283) Canadian Centre for Cyber Security
  7. Trivy: Supply-Chain Angriff führt zu Kompromittierungen in Deutschland (BITS-V 2026-237970-1032) BSI (Germany)
  8. European Commission cloud breach: a supply-chain compromise CERT-EU
  9. Cyber Brief 26-04 - March 2026 CERT-EU
  10. Security Update: Suspected Supply Chain Incident LiteLLM (BerriAI)

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Supply chain attack

A supply chain attack reaches its target by exploiting weaknesses in the products or services the target depends on.

Read more

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more