CVE-2026-33634: 
NixOS vulnerability analysis and mitigation

CVE-2026-33634 is a supply chain compromise (CWE-506: Embedded Malicious Code) affecting the Aqua Security Trivy ecosystem. On March 19, 2026, a threat actor (tracked as TeamPCP / UNC6780) used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. This was a continuation of an initial supply chain attack that began in late February 2026, where non-atomic credential rotation allowed the attacker to retain access. Affected components include: aquasecurity/trivy v0.69.4 (Go/container image), aquasecurity/trivy-action versions 0.0.1–0.34.2, and aquasecurity/setup-trivy versions 0.2.0–0.2.6 (prior to safe recreation of 0.2.6). The CVE carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 9.4 (Critical) (Github Advisory, Trivy Discussion).

The root cause is classified as CWE-506 (Embedded Malicious Code), introduced via compromised release credentials rather than a code vulnerability in Trivy itself. For the v0.69.4 binary, the attacker pushed a malicious commit (1885610c) that swapped the actions/checkout reference to an imposter commit (70379aad) containing a composite action that downloaded malicious Go source files from a typosquatted domain (scan.aquasecurtiy.org), and added --skip=validate to goreleaser to bypass binary validation. For trivy-action, the attacker force-pushed 76 tags to malicious commits that injected an infostealer into entrypoint.sh; this code dumped Runner.Worker process memory via /proc/<pid>/mem, swept 50+ filesystem paths for credentials, encrypted collected data using AES-256-CBC with RSA-4096 hybrid encryption, and transmitted it to attacker-controlled infrastructure. A fallback mechanism created a public tpcp-docs repository on the victim's GitHub account to upload stolen data if direct exfiltration failed. A detailed technical walkthrough of the attack chain, including the injected shell code, is available at (RoseSecurity).

Any CI/CD pipeline that executed a compromised Trivy version during the exposure windows had all accessible secrets — including SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, .env files, database passwords, and cryptocurrency wallets — subject to exfiltration. The malware operated with the full privileges of the GitHub Actions runner process, enabling complete confidentiality, integrity, and availability compromise of the affected pipeline environment. Downstream impact extended beyond Trivy itself: the litellm PyPI packages (v1.82.7, v1.82.8) and Telnyx Python SDK were also compromised as part of the same TeamPCP campaign, and real-world victims included organizations such as the European Commission (via CERT-EU attribution) and Cisco, with the compromise entering an extortion phase via the VECT ransomware affiliate program (Github Advisory, Halcyon).

CVE-2026-33634 was actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on March 26, 2026, with a remediation due date of April 9, 2026 (CISA KEV). The EPSS score is approximately 20.8–23.9%, placing it in the 96th percentile for exploitation likelihood. The threat actor is tracked as TeamPCP (also attributed by Google GTIG as UNC6780), a financially motivated group that conducted a broad supply chain campaign targeting developer tooling including Checkmarx, KICS, LiteLLM, and Telnyx. A detailed exploit walkthrough with actual injected shell code is publicly available (RoseSecurity), and a community-developed scanner for affected versions exists (CVE-2026-33634 Scanner). Microsoft published detection and defense guidance for the attack (Microsoft Blog).

1. Initial Access (Credential Theft): TeamPCP first compromised Aqua Security credentials in late February 2026 via an initial supply chain attack, exfiltrating tokens used for release pipelines.
2. Persistence via Non-Atomic Rotation: When Aqua Security performed credential rotation on March 1, 2026, the process was not atomic — the attacker used a still-valid token during the rotation window to exfiltrate newly rotated secrets, maintaining persistent access.
3. Typosquatted Infrastructure Setup: The attacker registered a typosquatted domain (scan.aquasecurtiy.org, note the transposed letters) and provisioned TLS certificates to serve as a C2/exfiltration endpoint.
4. Malicious Release Injection (v0.69.4): On March 19, 2026 at ~17:43 UTC, the attacker pushed a malicious commit (1885610c) to the Trivy repository, swapping actions/checkout to an imposter commit (70379aad) that downloaded malicious Go source files from the typosquatted domain. The --skip=validate flag was added to goreleaser to bypass validation, and the commit was tagged as v0.69.4, triggering the release pipeline.
5. GitHub Action Tag Hijacking: The attacker force-pushed 76 of 77 trivy-action version tags and all 7 setup-trivy tags to malicious commits containing an infostealer injected into entrypoint.sh.
6. Credential Harvesting on Victim Runners: When any CI/CD pipeline executed the compromised action, the malicious entrypoint.sh ran before the legitimate Trivy scan, dumping Runner.Worker process memory via /proc/<pid>/mem and sweeping 50+ filesystem paths for SSH keys, cloud credentials, Kubernetes tokens, .env files, and crypto wallets.
7. Encryption and Exfiltration: Collected data was encrypted using AES-256-CBC with RSA-4096 hybrid encryption and transmitted via HTTP POST to scan.aquasecurtiy.org (IP: 45.148.10.212).
8. Fallback Exfiltration: If direct exfiltration failed and INPUT_GITHUB_PAT was set, the malware created a public tpcp-docs-<random> repository on the victim's GitHub account and uploaded stolen data as a release asset.
9. Follow-on Docker Hub Compromise: On March 22, 2026, the attacker used separately-compromised Docker Hub credentials to push malicious images tagged as v0.69.5 and v0.69.6 directly to Docker Hub, extending the exposure window by ~10 hours (Github Advisory, RoseSecurity).

• Network:

  • Outbound connections to C2 domain scan.aquasecurtiy.org (note typosquatted spelling — extra 'r' in 'security')
  • Outbound connections to IP 45.148.10.212
  • HTTP POST requests to https://models.litellm.cloud/ (for litellm-related compromise)
  • DNS lookups for scan.aquasecurtiy.org from CI/CD runner hosts

• File System:

  • Presence of litellm_init.pth in Python site-packages/ directory (SHA256: ceNa7wMJnNHy1kRnNCcwJaFjWX3pORLfMh7xGL8TUjg)
  • Trivy v0.69.4 binaries matching known malicious SHA256 hashes (e.g., 385d498d18a3a7c67878ca7322716f9da25683eb1a4bf9e9592da0d5f2ab09f6 for Linux-64bit.tar.gz)
  • Container images with digests matching compromised v0.69.4/v0.69.5/v0.69.6 tags (e.g., sha256:27f446230c60bbf0b70e008db798bd4f33b7826f9f76f756606f5417100beef3 for 0.69.4)

• GitHub / Repository Artifacts:

  • Public repositories named tpcp-docs-* or tpcp-docs in your GitHub organization (fallback exfiltration indicator)
  • Release assets with tag prefix data- in such repositories
  • Workflow references to aquasecurity/trivy-action tags 0.0.1–0.34.2 (non-v-prefixed) or aquasecurity/setup-trivy versions 0.2.0–0.2.5

• Logs:

  • GitHub Actions workflow run logs from March 19–20, 2026 showing execution of aquasecurity/trivy-action or aquasecurity/setup-trivy
  • CI/CD logs showing unexpected curl or network activity during Trivy scan steps
  • Audit logs showing access to /proc/<pid>/mem from runner processes

• Process:

  • Unexpected child processes spawned by GitHub Actions runner reading from /proc/*/mem
  • Processes performing bulk filesystem sweeps of credential paths (.ssh/, .aws/, .kube/, .docker/) (Github Advisory, Trivy Discussion)

Immediate Actions:

1. Upgrade to safe versions: Trivy binary v0.69.2 or v0.69.3; trivy-action v0.35.0 (pinned to SHA aquasecurity/trivy-action@57a97c7); setup-trivy v0.2.6 (pinned to SHA aquasecurity/setup-trivy@3fb12ec).
2. Rotate all secrets: If any compromised version ran in your environment, treat all pipeline secrets as exposed and rotate immediately — including SSH keys, cloud provider credentials, API tokens, Kubernetes service account tokens, and Docker credentials.
3. Block C2 infrastructure: Block scan.aquasecurtiy.org and IP 45.148.10.212 at the network perimeter.
4. Audit GitHub Action references: Review all workflows using aquasecurity/trivy-action or aquasecurity/setup-trivy; check run logs from March 19–20, 2026.
5. Search for exfiltration artifacts: Look for repositories named tpcp-docs* in your GitHub organization.
6. Pin GitHub Actions to full SHA hashes: Replace mutable version tags with immutable commit SHA references to prevent future tag-hijacking attacks.
7. Verify binary integrity: Use cosign to verify Trivy binary signatures against the Sigstore transparency log for versions prior to v0.69.3 (Github Advisory, Trivy Discussion).

The incident generated significant industry attention. Aqua Security published a detailed customer advisory and security blog post, and Microsoft published detection and defense guidance on March 24, 2026 (Microsoft Blog). CISA added the vulnerability to its KEV catalog on March 26, 2026, with a 14-day remediation deadline. Canada's Cyber Centre (cyber.gc.ca) issued advisory AV26-283. Security researchers at Wiz, Arctic Wolf, Kaspersky, Legit Security, SOCRadar, and StepSecurity all published detailed analyses of the attack chain. The Hacker News community and Reddit's r/kubernetes and r/devsecops communities actively discussed the incident. CERT-EU later attributed a breach of the European Commission's infrastructure to this supply chain attack, and Halcyon reported the compromise entered an extortion phase via the VECT ransomware affiliate program. Google's GTIG formally tracked TeamPCP as UNC6780. The incident was widely cited as one of the most significant supply chain attacks of 2026, with downstream victims including Checkmarx, LiteLLM, Telnyx, Databricks (alleged), and Cisco (Github Advisory, Arctic Wolf, Halcyon).