CVE-2026-33634

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Setup-Trivy

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was…

23. Mär 2026

Ausgewertete Quellen

• Hinweis
  https://docs.litellm.ai/blog/security-update-march-2026
• Hinweis
  https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack
• Hinweis
  https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33634
• CISA
  Aquasecurity Trivy Embedded Malicious Code Vulnerability
• NVD
  CVE-2026-33634
• GitHub
  https://github.com/BerriAI/litellm/issues/24518
• GitHub
  https://github.com/BerriAI/litellm/issues/24518#issuecomment-4127436387
• GitHub
  https://github.com/aquasecurity/trivy/discussions/10425
• GitHub
  https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
• GitHub
  https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml
• GitHub
  https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc