CVE-2026-33634Trivy release and GitHub Action tags hijacked to steal CI secrets
What broke
On March 19, 2026, an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action and replace all 7 tags in aquasecurity/setup-trivy. Aqua's advisory, published March 21, calls it a continuation of a compromise that began in late February. After the first disclosure on March 1, credential rotation "was not atomic," so the attacker could have used a still-valid token to read the newly rotated secrets and keep access. Malicious v0.69.5 and v0.69.6 images later reached Docker Hub through separately compromised Docker Hub credentials. NVD scores it CVSS 3.1 8.8 and the CWE is CWE-506 (embedded malicious code).
The payload dumped the GitHub Actions Runner.Worker process memory through /proc/<pid>/mem, swept more than 50 paths for SSH keys, AWS, GCP and Azure credentials, Kubernetes tokens and .env files, encrypted the haul and sent it to a typosquatted domain. If that failed and a GitHub PAT was available, it created a public tpcp-docs- repository in the victim's account and uploaded the data there. CISA added it to KEV on March 26, 2026.
Why it matters
A security scanner runs with the same secrets as the pipeline it scans. The tj-actions incident a year earlier used the same moved-tag trick; this one adds a lesson about the publisher's own identities. A rotation that leaves any old token alive is not a rotation, because the attacker reads the new secrets with the old ones. Every CI job is a non-human identity, and a mutable tag decided which code ran with its credentials in memory.
What to do
- Move to Trivy v0.69.3 or v0.69.2, trivy-action v0.35.0 and setup-trivy v0.2.6, and pin actions to a full commit SHA.
- Verify binaries and images with cosign, and reference images by digest.
- Search your GitHub organization for
tpcp-docs-repositories and review workflow logs from March 19 to 20, 2026. - Replace stored cloud keys in CI with workload identity federation so a memory dump yields short-lived tokens.
After you patch
- Treat every secret any affected pipeline could read as exposed and rotate it. Revoke old credentials at the same moment you issue new ones. See secrets rotation.
Sources
Related identity CVEs
Related on Start with Identity
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto
- BlogPoisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository
- BlogThe developer toolchain is now the busiest identity perimeter
A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, an
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVEJFrog Artifactory checks a token's signature and issuer but not its scope
Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin acti
Technique
This CVE is an instance of Secrets in repositories and CI. A credential committed to a config file or pasted into a pipeline variable travels with every clone, fork, and log line, and it keeps working for as long as nobody notices it left the vault.