CVE-2026-33634 — Aquasecurity Trivy: Aquasecurity Trivy Embedded Malicious Code Vulnerability
CVE-2026-33634 — Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
What This Means For You
- CISA has confirmed active exploitation — immediate patching required.
- Added to CISA KEV catalog — federal agencies must remediate by 2026-04-09.
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-33634 | Supply Chain Compromise | Aquasecurity Trivy: Embedded malicious code allowing access to CI/CD environment secrets (tokens, SSH keys, cloud credentials, database passwords, sensitive configuration). |
Source & Attribution
| Source Platform | CISA |
| Channel | CISA KEV |
| Channel ID | cisa-kev |
| Message ID | 202633634 |
| Published | March 26, 2026 at 14:00 UTC |
| Original Link | This vulnerability involves a supply‑chain compromise in ... |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Found this interesting? Follow us on LinkedIn to stay ahead.
Share