CVE-2026-33634

CVE-2026-33634 details a critical supply chain attack against Trivy, a security scanner, where compromised credentials were used to publish a malicious v0.69.4 release and inject credential-stealing malware into specific versions of its GitHub Actions (`aquasecurity/trivy-action` and `aquasecurity/setup-trivy`). This vulnerability is rated 8.8 HIGH (CVSSv3.1) due to its network attack vector and high impact on confidentiality, integrity, and availability, potentially leading to widespread secret exfiltration from affected pipelines. The incident, a continuation of an earlier attack likely enabled by non-atomic credential rotation, is actively being exploited and has been added to CISA's Known Exploited Vulnerabilities catalog. Despite no public exploit code, it garners significant community attention and media coverage. Organizations must treat all secrets accessible to affected pipelines as compromised and rotate them immediately.