CVE-2026-33634

Aquasecurity Trivy contains an embedded malicious code vulnerability that allows attackers to exfiltrate all CI/CD secrets, including tokens, SSH keys, and cloud credentials.

This vulnerability enables attackers to access sensitive configuration and credentials stored in memory within the CI/CD environment, posing a severe supply-chain risk for DIB organizations relying on automated security scanning tools. The fact that it is actively exploited by threat actors and linked to ransomware campaigns means organizations must immediately patch or replace Trivy instances to prevent credential theft and unauthorized access to cloud infrastructure.

Shame score — The vendor shipped a tool with embedded malicious code that was actively exploited in the wild, indicating a critical failure in security controls and potentially negligent development practices.