Article
How a Trivy Compromise Reached LiteLLM Releases
LiteLLM says a Trivy compromise in its build pipeline led to bad PyPI releases. Sources differ on exposure time. See what to ask about…
Read more
Exploited vulnerability
Trivy supply chain compromise (CVE-2026-33634)
CVE-2026-33634
CVE-2026-33634 is not a coding bug in Trivy.
- On CISA KEV
- CVE ID
- CVE-2026-33634
- CISA KEV
- Listed
- Affected product
- Trivy scanner, trivy-action and setup-trivy GitHub Actions
- Exploited
- Yes
- Published
- March 2026
In short
CVE-2026-33634 is not a coding bug in Trivy. It is the number given to a supply chain compromise in March 2026, when an attacker used stolen credentials to publish a malicious Trivy release and to repoint the tags of two Trivy GitHub Actions at credential-stealing code. CISA lists it as an exploited embedded malicious code issue.
- CVECVE-2026-33634
- ProductAqua Security Trivy scanner, trivy-action and setup-trivy GitHub Actions
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUse only known safe versions · Rotate everything at once
What it allows
The bad code ran inside build pipelines before the real scan and, per the KEV entry, could give an attacker access to everything in the CI/CD environment, including tokens, SSH keys, cloud credentials and database passwords. The vendor says it read the runner's memory and could create a public repository named tpcp-docs on the victim's GitHub account to leave stolen data there. NVD scores it 8.8 (CVSS v3.1, NVD as primary scorer). GitHub, which assigned the record, scores it 9.4 (CVSS v4.0).
Who is affected
Per the vendor advisory: Trivy v0.69.4 (binary and container images), Docker Hub images v0.69.5 and v0.69.6, trivy-action before 0.35.0 and setup-trivy before 0.2.6. Safe versions are Trivy v0.69.2 and v0.69.3, trivy-action 0.35.0 and setup-trivy 0.2.6. Trivy v0.69.3 or earlier is not affected. The vendor says the malicious code was never committed to Trivy's main branch.
First malicious activity, as the vendor states it: 19 March 2026, 17:43 UTC. The vendor says this continued an attack that began in late February 2026, and that a first round of credential rotation was not done all at once. It says it removed the malicious releases within about four hours. On 22 March 2026 two more bad images appeared on Docker Hub. NVD published the record on 23 March 2026.
CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 26 March 2026 with a due date of 9 April 2026. The KEV entry lists ransomware campaign use as Unknown. The Canadian Cyber Centre said on 26 March 2026 that open-source reporting indicates exploitation. The German BSI warned the same day of compromises in Germany.
Attributed by CERT-EU, 2 April 2026, to TeamPCP, which it notes was a public attribution made by the vendor. The BSI, 26 March 2026, says the group TeamPCP is said to be behind it. CERT-EU assessed with high confidence that a stolen cloud key from this compromise gave initial access to the cloud account of an EU institution, where TruffleHog was run and about 91.7 GB of compressed data was taken. The vendor of LiteLLM says it believes its own later compromise came from Trivy in its build scanning.
Who exploits it
- Threat group TeamPCP The US FBI (July 2026) describes TeamPCP as a cyber criminal group behind large-scale software supply chain compromises of widely used developer and security tools. Since 2025
- Malware TruffleHog TruffleHog is a legitimate open source tool that searches for leaked passwords, API keys and other secrets in code, logs, chats and cloud storage. Legitimate tool abused · Since 2016 · IaaS, Linux, SaaS, Windows
Seen in
- Incident LiteLLM PyPI package compromise On 24 March 2026, two malicious versions of LiteLLM (1.82.7 and 1.82.8), a widely used AI gateway package, were published to PyPI with a credential stealer that looked for SSH keys, cloud credentials and Kubernetes tokens. March 2026 · Technology and software supply chain
- Incident Trivy scanner and GitHub Actions compromise In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing code. March 2026 · Technology and software supply chain
What to do
-
Use only known safe versions
Move to Trivy v0.69.2 or v0.69.3, trivy-action 0.35.0 and setup-trivy 0.2.6. Remove any copy of v0.69.4, v0.69.5 or v0.69.6 from hosts, registries and caches.
-
Rotate everything at once
The vendor says that if a bad version may have run, all secrets reachable by the pipeline must be treated as exposed and rotated at once. The vendor says its first, staggered rotation may have let the attacker keep access.
-
Pin actions to a full commit
The vendor says to pin GitHub Actions to full commit hashes, not version tags, because tags can be moved.
-
Block the vendor's indicators
The vendor recommends blocking its published command and control domain, scan[.]aquasecurtiy[.]org, and IP address 45[.]148[.]10[.]212 at the network edge.
-
Detect and hunt
Search your GitHub organization for repositories named tpcp-docs, which may show the fallback upload ran. Review workflow runs of trivy-action and setup-trivy from 19 and 20 March 2026, and cloud logs for new access keys on existing users.
Questions
What is CVE-2026-33634?
CVE-2026-33634 is the number given to a supply chain compromise of Trivy in March 2026. An attacker used stolen credentials to publish a malicious Trivy release and repoint GitHub Action tags at credential-stealing code. It is not a coding bug in Trivy.
Which Trivy versions are affected?
Trivy v0.69.4, Docker Hub images v0.69.5 and v0.69.6, trivy-action before 0.35.0 and setup-trivy before 0.2.6. Safe versions are Trivy v0.69.2 and v0.69.3, trivy-action 0.35.0 and setup-trivy 0.2.6.
What could the malicious Trivy code steal?
It ran inside build pipelines before the real scan. Per the CISA KEV entry, it could give an attacker access to everything in the CI/CD environment, including tokens, SSH keys, cloud credentials and database passwords.
Who was behind the Trivy compromise?
CERT-EU attributed it on 2 April 2026 to TeamPCP. The vendor says first malicious activity was 19 March 2026 and continued an attack that began in late February 2026.
In our research
- How a Trivy Compromise Reached LiteLLM Releases October 2026
- TeamPCP Threat group
Sources
- Trivy ecosystem supply chain was briefly compromised (GHSA-69fq-xp46-6x23) Aqua Security, via GitHub Advisory Database
- Trivy Security incident 2026-03-19 (Discussion 10425) Aqua Security
- CVE-2026-33634 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- CISA Adds One Known Exploited Vulnerability to Catalog, 26 March 2026 CISA
- Aqua Security security advisory (AV26-283) Canadian Centre for Cyber Security
- Trivy: Supply-Chain Angriff fuehrt zu Kompromittierungen in Deutschland (BITS-V 2026-237970-1032) BSI (Germany)
- European Commission cloud breach: a supply-chain compromise CERT-EU
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.