Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets

What to do

1. Grep workflows for trivy-action and setup-trivy references and check run logs from March 19-20, 2026
2. Pin actions to full commit SHAs and container images to digests
3. Rotate every secret available to affected jobs: cloud keys, GitHub PATs, registry creds, SSH keys, Kubernetes tokens, .env values
4. Search your GitHub org for tpcp-docs-* or docs-tpcp repos and data-<timestamp> releases
5. Block scan.aquasecurtiy.org, 45.148.10.212 and checkmarx.zone at egress
6. Verify Trivy binaries with cosign against the sigstore bundle

How to check if you are affected or compromised

• grep -rnE 'aquasecurity/(trivy-action|setup-trivy)@' .github/workflows/
• trivy --version (0.69.4, 0.69.5 or 0.69.6 = compromised); docker images --digests aquasec/trivy
• GitHub org search: repositories named tpcp-docs-* or docs-tpcp
• Proxy/DNS logs: scan.aquasecurtiy[.]org, 45.148.10.212, checkmarx[.]zone; runner logs mentioning tpcp.tar.gz

What happened#

On March 19, 2026, an attacker used still-valid Aqua Security credentials to turn the popular Trivy vulnerability scanner into a credential stealer, through several channels at once. Aqua's advisory, GHSA-69fq-xp46-6x23 (CVE-2026-33634), gives the details:

• The attacker force-pushed 76 of the 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy to malicious commits.
• The attacker also pushed a commit that swapped actions/checkout for an imposter commit and disabled goreleaser validation, then tagged it as Trivy v0.69.4. That release shipped to GitHub Releases, deb/rpm, GHCR, ECR Public, Docker Hub, get.trivy.dev and a custom Homebrew tap.
• On March 22, separately stolen Docker Hub credentials were used to push malicious 0.69.5 and 0.69.6 images.

The injected code runs before the real scan, so pipelines looked normal. It dumps the GitHub Runner.Worker process memory, sweeps more than 50 paths for SSH keys, cloud and Kubernetes credentials, Docker configs and .env files, and encrypts the haul with AES-256-CBC wrapped in RSA-4096. It sends the data to the typosquat scan.aquasecurtiy.org. If that fails and a PAT is available, it creates a public tpcp-docs-* repo on the victim's account and uploads the data there. The root cause was an incomplete fix for a late-February intrusion: credential rotation after the March 1 disclosure "was not atomic", so a token that had not yet been revoked could read the new secrets.

The stealer calls itself "TeamPCP Cloud stealer" (The Hacker News). Four days later the same tooling hit checkmarx/ast-github-action, checkmarx/kics-github-action, and the Open VSX extensions ast-results 2.53.0 and cx-dev-assist 1.7.0, exfiltrating to checkmarx[.]zone (THN). Stolen data from this spree reportedly fed later npm compromises.

Who is affected#

Aqua lists these exposure windows (UTC): trivy-action tags 0.0.1-0.34.2 from about 17:43 on March 19 to 05:40 on March 20 (about 12 hours); setup-trivy for about 4 hours; Trivy v0.69.4 from 18:22 to 21:42 on March 19; Docker Hub 0.69.5/0.69.6 and latest from 15:43 on March 22 to 01:40 on March 23. Workflows that SHA-pinned trivy-action to commits from before 2025-04-09 could still pull a malicious setup-trivy. CISA added CVE-2026-33634 to the KEV catalog on March 26, 2026.

Do you really need to act?#

This one hit security teams specifically, because Trivy runs in exactly the pipelines that hold deploy keys. If a job ran inside a window, assume it leaked every secret it had, including GITHUB_TOKEN scope, cloud OIDC sessions and registry credentials. The windows were short, though, and the clean signals are clear: a SHA pin to a recent commit, an image digest, the official Homebrew formula (built from source), or Trivy 0.69.3 or earlier means you were not exposed. Seven months on, the work is an audit and a rotation, plus fixing the tag-pinning habit that made this possible.

What to do now#

1. Find references: grep -rnE 'aquasecurity/(trivy-action|setup-trivy)@' .github/workflows/. Then pull Actions run logs for March 19-20, 2026, using gh run list --workflow <file> --created 2026-03-19..2026-03-23.
2. Move to trivy-action 0.35.0 (immutable) or a restored v-prefixed tag, setup-trivy v0.2.6, and Trivy v0.69.3 or later clean releases. Pin by full SHA and digest.
3. Rotate everything the affected jobs could reach: cloud keys and roles, GitHub PATs and app keys, registry credentials, SSH deploy keys, kubeconfigs, and database passwords.
4. Hunt for tpcp-docs-* or docs-tpcp repos and data-<timestamp> releases in your org. Delete them after preserving evidence.
5. Verify any Trivy binary you keep with cosign verify-blob against its sigstore bundle, and check that the Rekor timestamp predates March 19.

How to tell if you were hit#

trivy --version reporting 0.69.4, 0.69.5 or 0.69.6 means you ran a compromised build. Compare image digests with the advisory's IOC list (for example, the 0.69.4 tag is sha256:27f44623…eef3). Network indicators: scan.aquasecurtiy[.]org, 45.148.10.212, checkmarx[.]zone, and tpcp.tar.gz in runner output. On developer machines that ran 0.69.4, check for an unexpected systemd user service, which the malware uses for persistence.

Timeline#

• Mar 1, 2026 — Disclosure of an earlier Trivy intrusion; credential rotation is incomplete.
• Mar 19, 2026 — Tags hijacked from about 17:43 UTC; v0.69.4 published at 18:22 UTC.
• Mar 21, 2026 — Aqua publishes GHSA-69fq-xp46-6x23.
• Mar 22, 2026 — Malicious Docker Hub images 0.69.5 and 0.69.6 pushed (removed about 10 hours later).
• Mar 23, 2026 — Checkmarx actions and Open VSX extensions compromised with the same stealer.
• Mar 26, 2026 — CISA adds CVE-2026-33634 to KEV.

Vulnerability records

• CVE-2026-33634 · KEV 2026-03-26 · Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Aqua Security / GitHub — GHSA-69fq-xp46-6x23 Trivy supply chain compromise github.com
2. CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-33634) cisa.gov

Coverage and analysis

1. The Hacker News — Trivy security scanner GitHub Actions breached, 75 tags hijacked thehackernews.com
2. The Hacker News — TeamPCP hacks Checkmarx GitHub Actions using stolen CI credentials thehackernews.com