Research · Mar 23, 2026
Critical Vulnerability Identified in Aquasecurity Trivy: Malicious Code Injection
A significant security flaw has been discovered in Aquasecurity's Trivy, leading to the distribution of malicious code through compromised releases.
What changed
On March 19, 2026, a serious incident occurred involving Aquasecurity's Trivy, where threat actors exploited compromised credentials to publish a malicious version of the software. The attackers managed to force-push 76 out of 77 version tags, embedding credential-stealing malware within the releases.
Following this, on March 22, 2026, further malicious DockerHub images for Trivy versions v0.69.5 and v0.69.6 were published, escalating the threat to users.
Who is affected
The vulnerability primarily impacts users and organizations utilizing Aquasecurity's Trivy for container security scanning. The following groups are particularly at risk:
Organizations relying on DockerHub images for their CI/CD pipelines may inadvertently deploy compromised versions of Trivy, leading to potential credential theft and further exploitation.
- Users of Aquasecurity Trivy v0.69.4
- Organizations utilizing DockerHub for container images
- DevOps teams integrating Trivy into their CI/CD workflows
- Any entity that has pulled the affected versions of Trivy
What to do
Organizations should take immediate action to mitigate risks associated with this vulnerability. It is crucial to audit and verify the integrity of the Trivy versions in use.
Additionally, implementing strict credential management practices can help prevent similar incidents in the future.
- Upgrade to the latest secure version of Trivy immediately.
- Audit existing deployments for any signs of compromise.
- Review and enhance credential management policies.
- Monitor for unusual activity within your environments.