Research · Mar 23, 2026 · ZeroDay Catalog
Malicious Code Vulnerability Discovered in Aquasecurity Trivy
A recent security incident involving Aquasecurity's Trivy has led to the distribution of malicious code through compromised releases.
What changed
On March 19, 2026, a significant security breach was identified in Aquasecurity's Trivy tool. Threat actors exploited compromised credentials to publish a malicious version of Trivy v0.69.4, which included credential-stealing malware.
Subsequently, on March 22, 2026, the attackers released additional compromised DockerHub images for versions v0.69.5 and v0.69.6, further propagating the malicious code.
Who is affected
Organizations utilizing Aquasecurity's Trivy for vulnerability scanning and security assessments are at risk. The malicious releases could lead to unauthorized access and data breaches.
The following groups are particularly vulnerable:
- Users of Trivy v0.69.4, v0.69.5, and v0.69.6.
- Organizations relying on DockerHub for container images.
- Development teams integrating Trivy into CI/CD pipelines.
- Any entity utilizing the trivy-action GitHub Action for security scanning.
What to do
Immediate action is required to mitigate the risks associated with this vulnerability. Users should cease using the affected versions of Trivy and replace them with secure releases.
Additionally, organizations should conduct thorough security assessments to identify any potential breaches resulting from the use of the compromised versions.
- Upgrade to the latest secure version of Trivy as soon as possible.
- Review and rotate credentials that may have been compromised.
- Monitor systems for any signs of unauthorized access or data exfiltration.
- Implement additional security measures, such as enhanced logging and monitoring.