CVE-2026-33634 - Vulnerability Analysis

Overview

Aqua Security Trivy v0.69.4, trivy-action 0.0.1–0.34.2, and setup-trivy 0.2.0–0.2.6 contain a supply chain attack caused by compromised credentials allowing malicious code injection in releases and GitHub Actions, letting attackers steal credentials and exfiltrate secrets, exploit requires compromised credentials.

Severity & Score

Impact

Attackers can steal credentials and exfiltrate secrets, leading to full compromise of affected pipelines and environments.

Mitigation

Update to Trivy versions 0.69.2 or 0.69.3, trivy-action 0.35.0, and setup-trivy 0.2.6 with safe commits; rotate all exposed secrets and pin GitHub Actions to immutable commit SHAs

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
• https://github.com/aquasecurity/trivy/discussions/10425

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 24, 2026

CVE-2026-33634: CRITICAL supply chain vuln in aquasecurity Trivy & GitHub Actions (<0.2.6) — credential-stealing malware deployed. Rotate all secrets, use safe versions, audit logs for 'tpcp-docs'. Full details: https://radar.offseq.com/threat/cve-2026-33634-cwe-506-embedded-malicious-code-in--163a34d0 #OffSeq #SupplyChain #CVE2026_33634

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner