Aquasecurity Trivy Embedded Malicious Code Vulnerability
High Listed in CISA KEV
Summary
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Aquasecurity:Trivy
Sources
- CISA KEV DATABASE
Original Links
- https://nvd.nist.gov/vuln/detail/CVE-2026-33634 advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog kev
- https://github.com/advisories/GHSA-69fq-xp46-6x23 reference
Timeline
- kev_added CISA KEV
- kev_ingest CISA KEV