The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an Aquasecurity Trivy flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Aquasecurity Trivy flaw, tracked as CVE-2026-33634 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.
On March 19, 2026, attackers used compromised credentials to release a malicious version of Trivy (v0.69.4) and tamper with related GitHub Actions, turning them into tools for stealing sensitive data. This incident is part of an ongoing supply chain attack that began in late February. Although credentials were rotated after the initial breach, the process was not done simultaneously, likely allowing attackers to retain access and exploit newly generated secrets.
Several components were affected, including Trivy binaries, container images, and GitHub Actions. Safe versions have since been identified, but any system that ran the compromised versions should be treated as exposed.
Organizations are advised to remove affected artifacts, rotate all secrets, and review logs for suspicious activity, especially around March 19–20. To reduce risk, GitHub Actions should always be pinned to immutable commit hashes rather than version tags.
EXPLORE MORE
![Wanted: Suspect for Homicide in the 18th District [VIDEO]](https://thephillypi.com/wp-content/uploads/2026/05/Wanted-Suspect-for-Homicide-in-the-18th-District-VIDEO-768x512.jpg "Wanted: Suspect for Homicide in the 18th District [VIDEO]")
Wanted: Suspect for Homicide in the 18th District [VIDEO]
The Philadelphia Police Department is seeking the public’s help in identifying a…
Missing Juvenile Aiden Gregg from the 35th District Has Been Located
Missing Juvenile Aiden Gregg from the 35th District Has Been Located |…
Kazuma Kaneko’s Tsukuyomi announced, new premium release with less gen AI
Japanese developer COLOPL has announced Kazuma Kaneko’s Tsukuyomi, a new premium release…
Missing Juvenile Manayiah Brewington from the 22nd District
The Philadelphia Police Department is seeking the public’s assistance in locating a…
Trump trade rep says Canada pushing for ‘globalization’ rather than closer ties to US
A member of U.S. President Donald Trump’s administration said that the economies…
Former Germany’s foreign intelligence VP hit in Signal account takeover campaign
Former BND VP Arndt Freytag von Loringhoven was targeted in a Signal…
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by April 9, 2026.
