Constellation · CASCA

Constellation explorer

Every signal has a story.Follow the evidence.

Return to triage

Find a CVE by identifier or text

↵ select

Minimum eligible CVSSOrderKEV only

Start with evidence

Current exploration

CVE-2026-33634

Your trail

Where next?

CVE-2026-33634

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.

12 retained evidence references · snapshot-bound · open authoritative view

StateSource-scoped evidence

Priority72.3–74.9

Coverage93.8%

Connections10

Choose an action.

Evidence state

identity unresolved
known present
source constrained
evidence unknown

Snapshot-bound reason tuple

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Connections 10

has cited scope1 retained · stored CVE-2026-33634 → aquasecurity · setup-trivy

42511537-0e79-45db-8c21-b28d016b240b

has cited scope1 retained · stored CVE-2026-33634 → aquasecurity · trivy-action

862628fa-ce4b-489d-818d-6946e8e0f0c2

has cited scope1 retained · stored CVE-2026-33634 → BerriAI · LiteLLM

27c5e058-b58f-459f-a338-37451dcddcfb

has cited scope1 retained · stored CVE-2026-33634 → aquasecurity · trivy

9fcd241f-4224-4c9d-914f-0306c671d461

has cited scope1 retained · stored CVE-2026-33634 → team-telnyx · telnyx

4baa1aee-8b04-4f26-8f64-fb223eb84eec

has vulnerable target scope2 retained · stored CVE-2026-33634 → litellm · litellm

667a0b7f-28f3-45c6-a6c5-5c1dd9106e8993970c1d-c072-4ff2-bec6-5aa2fa688f8e

has vulnerable target scope1 retained · stored CVE-2026-33634 → aquasec · setup-trivy

f25e81f9-a1dc-4337-b995-022ac0690cdd

has vulnerable target scope2 retained · stored CVE-2026-33634 → telnyx · telnyx

1fb8ca9d-83a2-4c23-9cc2-a7f0f2ab97327b90b6d5-b723-426b-b5f7-d51e3d19eae4

has vulnerable target scope1 retained · stored CVE-2026-33634 → aquasec · trivy

5dc64703-038c-4df4-9563-56b3bdf1b436

has vulnerable target scope1 retained · stored CVE-2026-33634 → aquasec · trivy_action

7cbca8ab-869b-4555-95e4-afd3dc266a19

CVEProductSignalSelected / traceVisual proximity carries zero evidence weight.