# Trivy release and GitHub Action tags hijacked to steal CI secrets

Source: https://startwithidentity.com/cves/cve-2026-33634/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

On March 19, 2026, an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` and replace all 7 tags in `aquasecurity/setup-trivy`. Aqua's advisory, published March 21, calls it a continuation of a compromise that began in late February. After the first disclosure on March 1, credential rotation "was not atomic," so the attacker could have used a still-valid token to read the newly rotated secrets and keep access. Malicious v0.69.5 and v0.69.6 images later reached Docker Hub through separately compromised Docker Hub credentials. NVD scores it CVSS 3.1 8.8 and the CWE is CWE-506 (embedded malicious code).

The payload dumped the GitHub Actions `Runner.Worker` process memory through `/proc/<pid>/mem`, swept more than 50 paths for SSH keys, AWS, GCP and Azure credentials, Kubernetes tokens and `.env` files, encrypted the haul and sent it to a typosquatted domain. If that failed and a GitHub PAT was available, it created a public `tpcp-docs-` repository in the victim's account and uploaded the data there. CISA added it to KEV on March 26, 2026.

## Why it matters

A security scanner runs with the same secrets as the pipeline it scans. The [tj-actions incident](https://startwithidentity.com/cves/cve-2025-30066/) a year earlier used the same moved-tag trick; this one adds a lesson about the publisher's own identities. A rotation that leaves any old token alive is not a rotation, because the attacker reads the new secrets with the old ones. Every CI job is a [non-human identity](https://startwithidentity.com/glossary/workload-identity/), and a mutable tag decided which code ran with its credentials in memory.

## What to do

- Move to Trivy v0.69.3 or v0.69.2, trivy-action v0.35.0 and setup-trivy v0.2.6, and pin actions to a full commit SHA.
- Verify binaries and images with cosign, and reference images by digest.
- Search your GitHub organization for `tpcp-docs-` repositories and review workflow logs from March 19 to 20, 2026.
- Replace stored cloud keys in CI with [workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/) so a memory dump yields short-lived tokens.

## After you patch

- Treat every secret any affected pipeline could read as exposed and rotate it. Revoke old credentials at the same moment you issue new ones. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/).

## Sources

- [NVD: CVE-2026-33634](https://nvd.nist.gov/vuln/detail/cve-2026-33634)
- [Aqua Security advisory GHSA-69fq-xp46-6x23](https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23)
- [CISA Known Exploited Vulnerabilities catalog, added March 26, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33634)