What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs

What it is

Endor Labs' write-up of the March 2026 Trivy supply-chain compromise (CVE-2026-33634, CVSS 9.4). Its main point is that GitHub Actions are dependencies, and the root cause was a long-flagged pull_request_target misconfiguration. It also covers the blast radius and the exfiltration details that the summary leaves out.

How it works

flowchart TD
    A[Fork PR opened] --> B[pull_request_target workflow]
    B --> C{Checks out and runs PR code?}
    C -- No --> D[Safe: no untrusted execution]
    C -- Yes --> E[PAT exfiltrated]
    E --> F[Force-push tags in trivy-action and setup-trivy]
    F --> G[Pinned-by-tag consumers pull malware]
    G --> H[Credentials stolen, then reused downstream]

• The misconfiguration was introduced in October 2025. Boost Security's poutine tool flagged it publicly on November 29, 2025, more than three months before it was exploited.
• The PAT was extracted in late February 2026. Aqua disclosed and rotated credentials on March 1, but the page says the rotation may not have been atomic, so the attackers may have obtained the new tokens.
• On March 19 the attackers rewrote existing tags rather than publishing new releases. Because tags are mutable, a workflow pinned to something like trivy-action@v0.33.0 pulled malicious code with no visible change to the workflow file. Malicious Docker Hub images followed by March 22.
• The stealer swept over 50 filesystem paths for SSH keys. It also collected cloud keys (AWS, GCP, Azure), GitHub, GitLab and Jenkins tokens, and Kubernetes service account tokens and kubeconfigs.
• It queried AWS IMDS at 169.254.169.254 for IAM role credentials, and dumped the runner process memory via /proc/<pid>/mem to capture secrets that exist only in RAM.
• Exfiltration was AES-256-CBC with RSA-4096 key wrapping to scan.aquasecurtiy[.]org, a typosquat with transposed letters. The fallback used stolen GitHub tokens to create public repos in the victim's own account and upload the encrypted data as release assets.

Preconditions / Affected

• Any workflow that ran trivy-action or setup-trivy via a mutable tag during the compromise window.
• Any repo with a pull_request_target workflow that checks out and runs PR code. This is the originating pattern, and it applies whether or not you use Trivy.
• Reported impact (the page says "reportedly"): 10,000+ workflows ran the payload and 1,000+ SaaS environments were compromised. The page also links the breach to the later LiteLLM compromise and says access was reportedly handed to Lapsus$.

What to do

1. Search workflows for pull_request_target. If one checks out the PR's code and then builds, tests or runs scripts on it, refactor it, or restrict the checkout to the base branch.
2. Pin third-party Actions to a full commit SHA (trivy-action@a1b2c3d4e5f6..., the page's placeholder), not to @v2 or @v0.33.0. The page prioritises Actions that have access to secrets or run privileged.
3. Set GITHUB_TOKEN read-only by default at the org level and grant write only where needed. Avoid secrets: inherit and toJSON(secrets) in reusable workflows, since both expose every secret to every job in the chain.

For hunting, the page gives the domain scan.aquasecurtiy[.]org and unexpected public repos with release assets in your own accounts. It does not give a full list of indicators.

Caveats

• SHA pinning does not cover transitive dependencies. A SHA can also still point to an orphan commit in an attacker's fork. Review any later SHA change, such as a Dependabot update PR.
• The page does not describe remediation for anyone who already ran the compromised versions. Rotating all secrets reachable from those runners is an inference, not something it states.
• The blast-radius figures and the Lapsus$ handoff are described as reported, not confirmed. The post is also a vendor piece that promotes Endor Labs' policies.
• Advisory reference: GHSA-69fq-xp46-6x23.