What happened
CISA added CVE-2026-33634 (Aqua Security Trivy embedded malicious code vulnerability) to its Known Exploited Vulnerabilities (KEV) catalog on 2026-03-26.
KEV inclusion means U.S. federal agencies now have a formal remediation deadline (2026-04-09) and private-sector defenders should treat this as an actively exploited, high-priority risk.
This follows the recent Trivy supply-chain incident where compromised components could expose CI/CD secrets and cloud credentials.
Why this matters
Trivy and its related GitHub Action tooling are deeply integrated in build pipelines. If a compromised component runs in CI/CD, an attacker may gain access to:
- Repository tokens
- Cloud provider keys
- SSH material and deployment credentials
- Secrets loaded during build/test/release jobs
A KEV entry increases operational urgency: defenders should assume attacker interest is high and remediation windows are short.
How to check if you’re affected
Potentially affected environments
- Organizations using Trivy binaries, containers, or CI integrations during the recent supply-chain incident window.
- GitHub Actions workflows referencing mutable Trivy action tags or previously affected releases.
Quick verification steps
Inventory Trivy usage across CI/CD
- Search all repos and pipeline templates for
aquasecurity/trivy,trivy-action, andsetup-trivy.
- Search all repos and pipeline templates for
Validate what actually executed
- Review CI job history around the incident period and confirm exact action references (tag vs commit SHA) and artifact digests.
Check for unsafe versions/references
- Compare your references with vendor guidance and move to known-safe releases/SHAs immediately.
Assume secret exposure if uncertain
- Rotate GitHub, cloud, registry, and deployment secrets accessible to impacted jobs.
Harden pipeline trust boundaries
- Pin actions to immutable SHAs, minimize token scopes, and alert on unusual secret access or outbound connections.
Immediate defensive actions
- Patch/upgrade per Aqua guidance.
- Rotate all CI/CD secrets that could have been exposed.
- Re-run sensitive deployment workflows after cleanup with fresh credentials.
- Add controls to block mutable-tag action usage in production pipelines.
Sources
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog (primary source)
- https://www.cve.org/CVERecord?id=CVE-2026-33634 (primary source)
- https://github.com/aquasecurity/trivy/discussions/10425
Bottom line
CISA KEV status for CVE-2026-33634 is a clear escalation signal. If Trivy touches your CI/CD path, validate exposure now, rotate secrets, and enforce immutable dependency pinning before your next release cycle.