CVE-2026-33634: Aqua Security Trivy Supply Chain Attack -- Embedded Malicious Code

Background

Trivy is an open-source vulnerability scanner developed by Aqua Security and one of the most widely adopted container and infrastructure security scanning tools in the DevSecOps ecosystem. It is used to scan container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for known vulnerabilities, misconfigurations, and secrets. Trivy is integrated into CI/CD pipelines at thousands of organisations worldwide — including GitHub Actions workflows, GitLab CI pipelines, Jenkins jobs, and Tekton pipelines — as a gate check before deployment.

The supply chain attack surface of security tools is particularly high-value for attackers: a malicious code injection into a widely-used security scanner running in CI/CD pipelines provides access to the most sensitive secrets in an organisation’s infrastructure — the deployment credentials, cloud API keys, SSH keys, and tokens that the pipeline uses to build and deploy production systems. CISA added CVE-2026-33634 to the KEV catalogue on 2026-03-26.

Technical Mechanism

CVE-2026-33634 involves embedded malicious code in Trivy — a supply chain attack in which malicious functionality was introduced into the Trivy codebase, build artifacts, or distribution channels. Supply chain attacks of this type can occur via several mechanisms:

1. Compromised build pipeline: An attacker gains access to the build infrastructure (CI/CD system, artifact registry) and injects malicious code into published binaries or container images without modifying the source code
2. Dependency confusion / typosquatting: Malicious packages are published to package registries (npm, PyPI, Go modules) with names similar to legitimate dependencies
3. Upstream dependency compromise: A dependency of Trivy itself is compromised, and the malicious code propagates into Trivy builds
4. Direct repository compromise: The Trivy GitHub repository or release signing keys are compromised, and signed malicious releases are published

In any of these cases, the malicious code embedded in Trivy executes within the CI/CD pipeline context when Trivy is run as part of a security scan. The CI/CD environment typically has access to:

• CI/CD tokens (GitHub Actions GITHUB_TOKEN, GitLab CI tokens, etc.)
• Cloud credentials (AWS access keys, GCP service account keys, Azure credentials)
• SSH keys for deployment
• Docker registry credentials
• Kubernetes service account tokens

The malicious code exfiltrates these credentials to attacker-controlled infrastructure, enabling immediate access to cloud environments, code repositories, and production systems.

Real-World Exploitation Evidence

CVE-2026-33634 was added to CISA KEV on 2026-03-26. Supply chain attacks against developer and security tools represent a growing threat:

• 3CX and XZ Utils precedents — the 2023 3CX supply chain attack and the 2024 XZ Utils backdoor demonstrated that sophisticated attackers invest significant effort in compromising widely-deployed developer tools
• Security tool targeting — attackers specifically target security tools because they run with elevated privileges, in trusted contexts, and with access to the crown jewels of CI/CD pipelines
• Cloud credential theft — the primary objective of CI/CD supply chain attacks is obtaining cloud credentials; stolen AWS/GCP/Azure keys can immediately be used to access production data, provision cryptomining infrastructure, or establish persistent cloud access
• Broad blast radius — a single compromised Trivy installation in a CI/CD pipeline can expose all secrets used across that pipeline, potentially affecting hundreds of services and environments

Impact Assessment

The malicious code embedded in Trivy executes within the CI/CD pipeline context where Trivy is invoked, typically as a trusted security gate step. At that point in the pipeline, the environment contains the highest concentration of sensitive credentials in an organisation’s infrastructure: cloud provider access keys, container registry credentials, deployment tokens, SSH keys, and Kubernetes service account tokens. The malicious code exfiltrates these to attacker-controlled infrastructure, providing immediate access to cloud environments and production systems without any further exploitation steps needed. Affected organisations have no reliable way to distinguish attacker-initiated cloud API calls from normal pipeline activity until the credential theft is detected.

The organisational blast radius of a supply chain attack against a CI/CD security tool is unusually large. A single Trivy installation used across multiple pipelines exposes all secrets from every pipeline where it runs. Depending on how cloud credentials are scoped, a stolen AWS or GCP key may grant access to dozens of production services, databases, and object stores. The compounding factor is that Trivy is a security tool: its compromise undermines trust in the scan results it previously produced, creating uncertainty about whether vulnerabilities were accurately reported during the window of compromise. Affected organisations face both a credential rotation exercise across all cloud and CI/CD systems and a retrospective audit of Trivy scan outputs.

Affected Versions

Consult the Aqua Security security advisory and GitHub repository for the exact affected versions and verification guidance.

Remediation Steps

1. Immediately identify which version(s) of Trivy are running in all CI/CD pipelines and compare against the list of affected versions in the advisory
2. Stop using affected Trivy versions immediately and replace with verified clean versions
3. Pin Trivy to a specific, verified release using a cryptographic hash (container image digest or binary checksum):

   # GitHub Actions example
   - uses: aquasecurity/trivy-action@sha256:<verified_clean_sha>

4. Treat all secrets as compromised if any CI/CD pipeline ran an affected Trivy version:
   • Rotate all cloud provider credentials (AWS, GCP, Azure)
   • Rotate all CI/CD platform tokens
   • Regenerate all SSH keys used in affected pipelines
   • Rotate Docker registry credentials
   • Rotate any Kubernetes service account tokens
5. Audit cloud provider access logs for unexpected API calls in the period the affected Trivy version was deployed
6. Review CI/CD logs for unexpected outbound network connections during Trivy scan steps
7. Implement software supply chain security controls going forward:
   • Use SLSA (Supply-chain Levels for Software Artifacts) verified builds
   • Verify binary signatures before use
   • Pin dependencies to specific verified digests

Detection Guidance

CI/CD pipeline logs — review for:

• Unexpected outbound network connections from Trivy scan steps to non-Aqua infrastructure
• DNS queries to unexpected domains during Trivy execution
• Unexpected environment variable access during Trivy scan steps

Cloud provider audit logs:

• API calls from CI/CD service accounts at unexpected times or from unexpected source IP addresses
• New IAM role, policy, or user creation by CI/CD service accounts
• Data access patterns inconsistent with normal build/deploy workflows

SIEM query example (Splunk):

index=cloud_audit sourcetype=aws_cloudtrail
| where userIdentity.arn like "*ci-cd*" OR userIdentity.arn like "*github-actions*"
| where eventTime > "2026-01-01" AND sourceIPAddress!="known_ci_cd_ips"
| stats count by userIdentity.arn, eventName, sourceIPAddress
| where count > 5
| sort -count

Network monitoring in CI/CD:

• Monitor outbound connections from CI/CD runners during security scan steps
• Alert on connections to unknown external IP addresses from within the build environment

Timeline

References

• NVD — CVE-2026-33634
• CISA KEV — CVE-2026-33634
• MITRE CVE — CVE-2026-33634