// threat brief

CVE-2026-33634Actively exploited

Trivy supply chain attack: a security scanner laced with credential-stealing code, spreading all the way to LiteLLM and Checkmarx

CVSS: 8.8 HIGH
CISA KEV: 2026-03-26
Weakness: CWE-506
Topics: Supply chain · AI security

PlainCVE Team · Published 2026-09-23 · Updated 2026-09-24 · AI-assisted · Press brief ↓

Human review 2026-09-23Command tests: none yetReproduced: not yetVerification record ↓

Attackers hijacked Trivy's releases to ship a credential stealer; secrets taken from CI pipelines that ran it were then used to poison LiteLLM and others.

Who is affected	Anyone who, between 2026-03-19 and 03-23 (windows differ per component; see the table), used Trivy v0.69.4 / 0.69.5 / 0.69.6 in CI or locally or referenced aquasecurity/trivy-action or setup-trivy by version tag; and anyone who installed litellm 1.82.7 / 1.82.8 on 03-24.
What happens	Any secret reachable from the CI environment (cloud keys, GitHub tokens, SSH keys, package publishing tokens, Kubernetes credentials) may have leaked, letting attackers publish code or get into your cloud as you.
What to do now	Switch to a clean version, treat every secret the affected pipelines could access as leaked and rotate it, and reference GitHub Actions by full commit SHA. View evidence(4) Vendor / maintainerAqua recommends treating every secret the affected pipelines could access as leaked and rotating it immediately.all secrets accessible to affected pipelines must be treated as exposed and rotated immediatelygithub.com Vendor / maintainerAqua recommends checking computers that ran the malicious Trivy outside CI for ~/.config/systemd/user/sysmon.py and related systemd user service files.check for the presence of ~/.config/systemd/user/sysmon.py and associated systemd user unit filesaquasec.com CVE recordThe CVE record recommends referencing GitHub Actions by full commit SHA instead of mutable version tags.Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.cve.org Our assessmentPlainCVE's own recommendations: pin the tool versions actions download (don't set trivy-action's version to latest), verify signatures with cosign / sigstore, switch package publishing to OIDC Trusted Publishing, and pin dependencies with a lockfile + hashes.
Affected versions	trivy v0.69.4 (all channels), 0.69.5 / 0.69.6 (Docker Hub only); trivy-action tags 0.0.1–0.34.2; setup-trivy tags v0.2.0–v0.2.6; litellm 1.82.7 / 1.82.8 View evidence(4) Vendor / maintainerAqua's advisory says trivy v0.69.4 was affected on every download channel, and 0.69.5 / 0.69.6 only on Docker Hub.trivy container images v0.69.5 and v0.69.6 (or latest during the exposure window) distributed via Docker Hub.github.com Vendor / maintainerAqua's advisory says trivy-action tags 0.0.1–0.34.2 and setup-trivy tags v0.2.0–v0.2.6 were affected; a SHA-pinned trivy-action could still be hit by explicitly setting version: latest during the exposure window or by pinning to a commit from before 2025-04-09.SHA pinning to a commit prior to 2025-04-09.github.com Vendor / maintainerLiteLLM's advisory says litellm 1.82.7 / 1.82.8 on PyPI were compromised and were quarantined about 40 minutes after going live on 03-24.Those packages were live on March 24, 2026 from 10:39 UTC for about 40 minutes before being quarantined by PyPI.docs.litellm.ai Vulnerability databaseOSV's PYSEC-2026-2 lists litellm 1.82.7 / 1.82.8 as affected.Two litellm versions published containing credential harvesting malwareosv.dev
Fixed versions	trivy v0.69.3 or earlier, or a later clean version; trivy-action 0.35.0; setup-trivy v0.2.6 (rebuilt); litellm 1.83.0 View evidence(3) Vendor / maintainerAqua's advisory lists the clean versions: trivy v0.69.2, v0.69.3; trivy-action 0.35.0; setup-trivy v0.2.6 (rebuilt).We have removed all malicious releases within ~4 hours and re-created v0.2.6 with safe content.github.com CVE recordThe CVE record lists the same clean versions: trivy 0.69.2, 0.69.3; trivy-action 0.35.0; setup-trivy 0.2.6.Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy.cve.org Vendor / maintainerLiteLLM's advisory says 1.82.6 or earlier and 1.83.0 are clean, and users of the official Docker image were not affected.A new clean version of LiteLLM is now available (v1.83.0).docs.litellm.ai
CVSS vector	Show full vector `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
Timeline	Introduced 2026-03-19 · Malicious trivy-action tags and v0.69.4 published source First public 2026-03-19 First attacks 2026-03-19 · Active compromise observed, contained ~20:38 UTC source
CISA KEV	Listed (2026-03-26): attacks have been seen in the wild View evidence(4) CERT / governmentCISA added CVE-2026-33634 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-03-26.CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.cisa.gov Vendor / maintainerAqua says the attack happened on 2026-03-19 and was contained around 20:38 UTC.The Trivy team identified and contained the attack, removing malicious artifacts from distribution channels.aquasec.com Vendor / maintainerAqua's advisory explains that the attacker used compromised credentials to publish the malicious releases; the March 1 credential rotation was not done all at once, which may be how the attacker kept access.Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously).github.com Vendor / maintainerLiteLLM believes its compromise originated from Trivy, which its CI security scanning workflow used.We believe that the compromise originated from the Trivy dependency used in our CI/CD security scanning workflow.docs.litellm.ai

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?

01Review CI run logs and look for unfamiliar repos
Review workflow run logs from 03-19 to 03-20, and check your GitHub organization for an unfamiliar repo named tpcp-docs. CI, local machines, and litellm hosts are three separate checks; finishing one doesn't mean you can skip the others.
Step 2 Step 3
02Check how you reference trivy-action
Workflows that reference trivy-action or setup-trivy by version tag are in scope. Two ways a SHA-pinned trivy-action could still be hit (Aqua advisory): explicitly setting version: latest during the exposure window, where the action itself was safe but downloaded the malicious Trivy 0.69.4; or pinning to a commit from before 2025-04-09, when trivy-action called setup-trivy by tag, and every setup-trivy tag was replaced with a malicious commit on 3/19.
Step 2
03Check computers that ran the malicious Trivy locally
Aqua recommends: on computers that ran the malicious Trivy outside CI, check for ~/.config/systemd/user/sysmon.py and related systemd user service files in the same folder.
Step 3
04Confirm which litellm version was installed
1.82.8 leaves a litellm_init.pth file, but 1.82.7 has no such file, so not finding a .pth file doesn't mean you're safe. Check lockfiles, CI and Docker build logs, or list the site-packages folder.
Step 5

MITIGATEFix / mitigatePatch; block it if you cannot patch yet

01Move Trivy and the related actions to clean versions
Remove Trivy v0.69.4 / 0.69.5 / 0.69.6. Clean versions: trivy v0.69.2, v0.69.3; trivy-action 0.35.0; setup-trivy v0.2.6 (rebuilt). For the exact Checkmarx KICS Action versions, refer to Checkmarx's official page.
Step 2
02Move litellm to a clean version
Remove litellm 1.82.7 / 1.82.8 and use 1.82.6 or earlier, or 1.83.0. Users of LiteLLM's official Docker image are not affected.
Step 5

RESPONDRespondIf you find signs of compromise

01Rotate every secret the affected pipelines could access
Aqua recommends treating every secret as leaked, including cloud keys, GitHub tokens, SSH keys, package publishing tokens, and database and Kubernetes credentials. Rotate them all at once, not in batches.
Step 1 Step 3 Step 4
02Remove persistence files
Aqua recommends removing ~/.config/systemd/user/sysmon.py and related systemd user service files immediately if found; on hosts that installed litellm 1.82.8, remove litellm_init.pth if found.
Step 3 Step 5
03Only read files when checking Python environments; don't run python or pip
Check a possibly infected environment only by reading files, for example with find, ls, grep. Starting Python runs .pth files, which would trigger the malicious code again.
Step 5

HARDENHardenPrevent the next one

01Reference GitHub Actions by full commit SHA, and pin tool versions too
PlainCVE recommends: besides pinning the action, check that the tool versions it downloads are pinned too (don't set trivy-action's version to latest); enable immutable releases.
Step 2
02Verify signatures and restrict CI's outbound connections
PlainCVE recommends: verify Trivy binary and image signatures with cosign / sigstore; restrict CI's outbound connections; keep CI permissions to a minimum.
Step 1 Step 3
03Switch package publishing to OIDC Trusted Publishing
PlainCVE recommends not keeping long-lived tokens in CI. Don't make the trust too broad: npm's docs recommend pairing it with a deployment environment that requires approval, and using tag protection rules to control who can create release tags.
Step 4
04Pin dependency versions and delay adopting new releases
PlainCVE recommends: pin dependency versions with a lockfile + hashes, and don't install new releases the moment they are published.
Step 5

Full remediation steps and notes

Switch to a clean version. Check each component against the table above and remove Trivy v0.69.4 / 0.69.5 / 0.69.6 and litellm 1.82.7 / 1.82.8.
Rotate secrets. Aqua recommends treating every secret the affected pipelines could access as leaked, including cloud keys, GitHub tokens, SSH keys, package publishing tokens, and database and Kubernetes credentials.
Look for traces. These are three separate checks; finishing one doesn’t mean you can skip the others:
- CI: Review workflow run logs from 03-19 to 03-20, and check your GitHub organization for an unfamiliar repo named tpcp-docs.
- Computers that ran the malicious Trivy locally (outside CI): Aqua recommends checking for ~/.config/systemd/user/sysmon.py and related systemd user service files in the same folder, and removing them immediately if found.
- Hosts that installed the malicious litellm: 1.82.8 leaves a litellm_init.pth file; remove it if found. But 1.82.7 has no such file, so not finding a .pth file doesn’t mean you’re safe. Check lockfiles, CI and Docker build logs, or list the site-packages folder to see which litellm version was installed.
- When checking a possibly infected Python environment, only read files (for example with find, ls, grep). Don’t run python or pip: starting Python runs .pth files, which would trigger the malicious code again.
Long-term hardening.
- Always reference GitHub Actions by full commit SHA, and check that the tool versions they download are pinned too (for example, don’t set trivy-action’s version to latest).
- Verify Trivy binary and image signatures with cosign / sigstore.
- Switch package publishing to OIDC Trusted Publishing and don’t keep long-lived tokens in CI. But don’t make the trust too broad: npm’s docs recommend pairing it with a deployment environment that requires approval, and using tag protection rules to control who can create release tags.
- Rotate credentials all at once, not in batches.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.

Attacker
Exploits a misconfiguration in Trivy's GitHub Actions to obtain a high-privilege token
Late February 2026. The project rotated credentials on March 1, but not all at once, which may be how the attacker kept access.
Defense: Rotate credentials all at once; keep CI permissions to a minimum.
Attacker
Repoints existing version tags to malicious code and publishes v0.69.4
Anyone referencing trivy-action by tag automatically ran the malicious version on their next run; the official release pipeline also shipped v0.69.4 to every download channel as usual.
Defense: Reference GitHub Actions by full commit SHA, and pin the tool versions the actions download too (do not use version latest for trivy-action); enable immutable releases.
Your system
The victim's CI runs its "security scan"
Before doing any real scanning, the malicious code collects secrets from the runner's memory and more than 50 file locations, encrypts them, and sends them out.
Defense: Verify binary and image signatures with cosign / sigstore; restrict CI's outbound connections.
Attacker
Uses the stolen publishing tokens to poison the next project
LiteLLM's CI used Trivy for scanning, so its PyPI token leaked, and the attacker uploaded litellm 1.82.7 / 1.82.8 directly. Checkmarx says its KICS GitHub Action was also tampered with using credentials obtained in this attack.
Defense: Switch package publishing to OIDC Trusted Publishing, don't keep long-lived tokens in CI, and only allow publishing from a deployment environment that requires manual approval.
Your system
People who install the new litellm get their secrets stolen too
The two versions trigger differently. 1.82.7 runs when LiteLLM's proxy server module (proxy_server) is loaded; 1.82.8 also adds a .pth file that runs whenever any Python program starts. The malicious code steals keys and sets up persistence on the host.
Defense: Pin dependency versions (lockfile + hashes); delay adopting new releases.

Who is affected

Component	Affected	Exposure window (UTC)	Clean versions
trivy binaries and images (all channels)	v0.69.4	03-19 18:22 – about 21:42	v0.69.2, v0.69.3
trivy Docker Hub images	0.69.5, 0.69.6	03-22 15:43 – 03-23 about 01:40	0.69.3
aquasecurity/trivy-action	76 tags, 0.0.1–0.34.2	03-19 about 17:43 – 03-20 about 05:40	0.35.0
aquasecurity/setup-trivy	All tags v0.2.0–v0.2.6	03-19 about 17:43 – about 21:44	v0.2.6 (rebuilt)
PyPI litellm	1.82.7, 1.82.8	About 40 minutes starting 03-24 10:39	1.82.6 or earlier, 1.83.0

Cases Aqua says are not affected: Trivy v0.69.3 or earlier, images referenced by digest, builds compiled from source yourself, the official Homebrew package (brew install trivy), and trivy-action referenced by a commit SHA from after 2025-04-09. Users of LiteLLM’s official Docker image are also not affected.

Two ways a SHA-pinned trivy-action could still be hit (Aqua advisory): first, explicitly setting version: latest during the exposure window - the action itself was safe, but it downloaded the malicious Trivy 0.69.4; second, pinning to a commit from before 2025-04-09, when trivy-action called setup-trivy by tag, and every setup-trivy tag was replaced with a malicious commit on 3/19. So besides pinning the action, make sure the Trivy version it downloads is pinned too.

Checkmarx’s KICS GitHub Action and some of its IDE extensions were also tampered with on 03-23, but they have no separate CVE. Refer to Checkmarx’s official page for the exact versions.

How it works

This isn’t a single wrong line of code. It’s a chain of trust being taken over. The software supply chain rests on two assumptions that people often overlook:

“Version tags don’t change.” Many people write uses: aquasecurity/trivy-action@0.34.0 in their GitHub Actions. But Git tags can actually be moved. Once the attacker had access, they repointed existing tags to a malicious commit, and every workflow that referenced them by tag automatically ran the malicious version on its next run, without anyone touching a config file.
“Anything that comes out of the official release pipeline is safe.” The attacker pushed a v0.69.4 tag, and Trivy’s own CI built it and published it to GitHub, Docker Hub, package repositories, and every other channel as usual.

And Trivy is a security scanner: it is placed in CI on purpose and given permission to read the code and the environment. The malicious version exploited exactly that, collecting secrets on the runner and sending them out before it did any scanning.

The last link is spread: LiteLLM’s CI used Trivy for scanning, so its PyPI publishing token leaked, and the attacker used it to upload a malicious litellm. This is what a supply chain attack looks like as it snowballs from one victim to the next.

The flawed approach:

Show code example(yaml)

# Tags can be moved, so the code they point to may change without you knowing
- uses: aquasecurity/trivy-action@0.34.0

The fixed approach:

Show code example(yaml)

# Reference by full commit SHA so the content can't be swapped out; the comment notes the matching version for easier maintenance
- uses: aquasecurity/trivy-action@<full 40-character commit SHA>  # v0.35.0

Timeline

Date (UTC)	Event
Late 2026-02	Attacker exploits a Trivy GitHub Actions misconfiguration to obtain a high-privilege token
2026-03-01	First incident disclosed; credentials rotated, but not all at once
2026-03-19	trivy-action / setup-trivy tags tampered with; v0.69.4 published
2026-03-21	Aqua publishes a GitHub security advisory
2026-03-22	Malicious 0.69.5 / 0.69.6 appear on Docker Hub
2026-03-23	Checkmarx KICS Action tampered with; CVE published
2026-03-24	Malicious litellm 1.82.7 / 1.82.8 quarantined on PyPI after about 40 minutes
2026-03-26	CISA adds it to the Known Exploited Vulnerabilities catalog

Verification Reviewed and checked against sources; not yet reproduced in our lab

Reviewed	2026-09-23

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

AdvisoryGHSA-69fq-xp46-6x23 — Trivy ecosystem supply chain briefly compromised · Aqua Security (GitHub), 2026-03-21 · accessed 2026-09-23
CVE / NVD / OSVCVE-2026-33634 Record · CVE Program, 2026-03-23 · accessed 2026-09-23
The CNA (GitHub) CVSS 4.0 score is 9.4; the NVD CVSS 3.1 score is 8.8.
CVE / NVD / OSVNVD - CVE-2026-33634 · NIST · accessed 2026-09-23
AdvisoryCISA Adds One Known Exploited Vulnerability to Catalog · CISA, 2026-03-26 · accessed 2026-09-23
VendorTrivy supply chain attack: what you need to know · Aqua Security · accessed 2026-09-23
AdvisoryPYSEC-2026-2 (litellm) · PyPA / OSV, 2026-03-24 · accessed 2026-09-23
VendorLiteLLM security update, March 2026 · BerriAI, 2026-03-24 · accessed 2026-09-23
VendorCheckmarx ongoing security updates · Checkmarx · accessed 2026-09-23
ResearchDetecting, investigating, and defending against the Trivy supply chain compromise · Microsoft Security Blog, 2026-03-24 · accessed 2026-09-23
VendorTrusted publishing for npm packages · npm Docs · accessed 2026-09-24

Press brief

In one sentence

In March 2026, Trivy, a widely used open-source security scanner, was compromised, and its official releases were laced with code that steals passwords and keys. Development teams that used it to scan their code had their keys stolen, and those keys were then used to poison other popular packages, including the AI gateway LiteLLM. The US agency CISA added this incident to its Known Exploited Vulnerabilities catalog on March 26.

Quotable line

The attackers didn't break into each company one by one. They broke into the tool everyone trusts and runs automatically, and let it fetch the keys for them.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

Trivy supply chain attack: a security scanner laced with credential-stealing code, spreading all the way to LiteLLM and Checkmarx

In March 2026, Trivy, a widely used open-source security scanner, was compromised, and its official releases were laced with code that steals passwords and keys. Development teams that used it to scan their code had their keys stolen, and those keys were then used to poison other popular packages, including the AI gateway LiteLLM. The US agency CISA added this incident to its Known Exploited Vulnerabilities catalog on March 26.

「The attackers didn't break into each company one by one. They broke into the tool everyone trusts and runs automatically, and let it fetch the keys for them.」— PlainCVE
https://plaincve.date/en/vulns/cve-2026-33634-trivy-supply-chain

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Trivy supply chain attack: a security scanner laced with credential-stealing code, spreading all the way to LiteLLM and Checkmarx". PlainCVE. https://plaincve.date/en/vulns/cve-2026-33634-trivy-supply-chain (accessed YYYY-MM-DD)

BibTeX

@misc{cve202633634trivysupplychain2026,
  title  = {Trivy supply chain attack: a security scanner laced with credential-stealing code, spreading all the way to LiteLLM and Checkmarx},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-33634-trivy-supply-chain},
  note   = {Updated 2026-09-24}
}