The Trivy Supply Chain Ambush: How a Vulnerability Scanner Became the Attack Vector
Between March 19 and 23, 2026, threat actors compromised Aqua Security's CI/CD pipeline and poisoned Trivy images with malware. If you pulled the wrong version, your secrets are at risk.
⚡ Key Takeaways
- Attackers compromised Aqua Security's CI/CD pipeline and poisoned Trivy images on Docker Hub between March 19-23, 2026, embedding an infostealer that targeted CI/CD secrets, cloud credentials, and SSH keys. 𝕏
- The attack was especially dangerous because Trivy is a security scanner that typically runs with elevated permissions and socket access in CI/CD pipelines, giving compromised images near-root access. 𝕏
- You can check if you're affected by searching your local registries and artifact repositories for three specific compromised image digests; if found, remove them immediately and rotate all credentials that system could have accessed. 𝕏
Worth sharing?
Get the best Open Source stories of the week in your inbox — no noise, no spam.
Originally reported by Docker Blog
Related Stories
Security & Privacy
Anthropic's One-Line Fumble Leaks Billions in Code
Security & Privacy
Invisible Code Is Now Flooding GitHub. Your Code Review Won't Catch It.
Security & Privacy
Trivy's Poisoned Release: One Malicious Version Hits Thousands of Pipelines
DevOps & Infrastructure