Sophisticated Supply Chain Attack Compromises Trivy GitHub Action, Exposing CI/CD Pipelines Globally
In late March 2026, a high-impact supply chain attack targeted the official Trivy GitHub Action (aquasecurity/trivy-action), a widely used security scanning tool in continuous integration and continuous deployment (CI/CD) pipelines. Threat actors executed a force-push attack, compromising 75 out of 76 existing version tags to distribute a malicious infostealer designed to exfiltrate credentials.
This incident is the second Trivy-related compromise in a single month, raising concerns about a potential pattern of targeted attacks. With over 10,000 GitHub workflows relying on the affected action, the breach exposes a vast number of organizations to credential theft undermining the very tool meant to secure their pipelines.
The attack highlights the escalating risk of supply chain vulnerabilities in CI/CD environments, where trusted dependencies can become vectors for exploitation. Security teams are advised to prioritize strict version control, dependency validation, and continuous monitoring to mitigate similar threats. The incident underscores the need for rigorous verification of third-party tools, even those positioned as security solutions.
Source: https://www.linkedin.com/feed/update/urn:li:activity:7441155881570021376
The Apache Software Foundation cybersecurity rating report: https://www.rankiteo.com/company/the-apache-software-foundation
Aquasol cybersecurity rating report: https://www.rankiteo.com/company/aquasol
"id": "THEAQU1774117492",
"linkid": "the-apache-software-foundation, aquasol",
"type": "Cyber Attack",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Over 10,000 GitHub workflows',
'industry': 'Technology, Software Development',
'location': 'Global',
'name': 'Organizations using Trivy GitHub Action',
'size': 'Various',
'type': 'Various'}],
'attack_vector': 'Force-push attack on GitHub Action version tags',
'data_breach': {'data_exfiltration': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Credentials'},
'date_detected': '2026-03',
'description': 'In late March 2026, a high-impact supply chain attack '
'targeted the official Trivy GitHub Action '
'(aquasecurity/trivy-action), a widely used security scanning '
'tool in continuous integration and continuous deployment '
'(CI/CD) pipelines. Threat actors executed a force-push '
'attack, compromising 75 out of 76 existing version tags to '
'distribute a malicious infostealer designed to exfiltrate '
'credentials. This incident is the second Trivy-related '
'compromise in a single month, raising concerns about a '
'potential pattern of targeted attacks. With over 10,000 '
'GitHub workflows relying on the affected action, the breach '
'exposes a vast number of organizations to credential theft, '
'undermining the very tool meant to secure their pipelines.',
'impact': {'brand_reputation_impact': 'Undermined trust in security tools',
'data_compromised': 'Credentials',
'identity_theft_risk': 'High',
'operational_impact': 'Exposure of CI/CD pipelines to credential '
'theft',
'systems_affected': 'CI/CD pipelines using Trivy GitHub Action'},
'initial_access_broker': {'entry_point': 'GitHub Action version tags'},
'lessons_learned': 'The incident highlights the escalating risk of supply '
'chain vulnerabilities in CI/CD environments, where '
'trusted dependencies can become vectors for exploitation. '
'Security teams are advised to prioritize strict version '
'control, dependency validation, and continuous '
'monitoring.',
'motivation': 'Credential theft, data exfiltration',
'post_incident_analysis': {'root_causes': 'Supply chain compromise, '
'force-push attack on version tags'},
'recommendations': 'Prioritize strict version control, dependency validation, '
'and continuous monitoring of third-party tools, even '
'those positioned as security solutions.',
'title': 'Sophisticated Supply Chain Attack Compromises Trivy GitHub Action, '
'Exposing CI/CD Pipelines Globally',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Supply chain compromise in CI/CD dependencies'}