Trivy Explained: Scanning Images, Repositories, IaC and Kubernetes, and What the 2026 Compromise Taught

Trivy is one of the most widely used open-source security scanners: a single binary that scans container images, repositories, infrastructure code and Kubernetes clusters. It is also, since March 2026, the standard example of a security tool becoming the attack path, which makes it a doubly good interview topic.

What it is

Trivy is maintained by Aqua Security under the Apache-2.0 licence. It scans several kinds of target:

• container images, filesystems and root filesystems
• git repositories and virtual machine images
• Kubernetes clusters
• SBOMs (CycloneDX and SPDX)

Its scanners cover known vulnerabilities, IaC misconfigurations, secrets, licences and cryptographic assets. It can also generate SBOMs. It is detection only: it reports problems, and fixing them is up to you.

How it works

Trivy downloads its vulnerability database as an OCI artifact (from mirror.gcr.io by default, falling back to ghcr.io), inventories operating system and language packages in the target, and matches them locally. For air-gapped environments you can mirror the database and point Trivy at it with --db-repository, or skip updates with --skip-db-update.

The compromise. According to GitHub advisory GHSA-69fq-xp46-6x23 (CVE-2026-33634) and Aqua's disclosure, attackers first stole a privileged token in late February 2026 through a misconfiguration in Trivy's GitHub Actions environment. Aqua rotated credentials, but later said the rotation "wasn't atomic", and the attacker kept access. On 19 March 2026 they published a malicious Trivy v0.69.4 and force-pushed 76 of the 77 aquasecurity/trivy-action tags and all 7 setup-trivy tags. Malicious Docker Hub images 0.69.5 and 0.69.6 followed on 22 and 23 March. The injected code ran before the real scan, read secrets from the runner's memory and sent them to a look-alike domain. Fixed versions are Trivy v0.69.3, trivy-action v0.35.0 and setup-trivy v0.2.6. Aqua said it had no indication its commercial products were affected.

How to use it

Day one: scan an image and a repository

trivy image python:3.12-slim
trivy fs --scanners vuln,secret,misconfig .
trivy k8s --report summary cluster
trivy image --format cyclonedx --output sbom.json myapp:1.4

Week one: build a gate developers accept

trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed myapp:1.4

--ignore-unfixed hides vulnerabilities with no available fix, so the gate only fails on something a developer can act on. Record accepted risks in .trivyignore, one ID per line with a comment and an optional exp: date so exceptions expire. For a richer, auditable record, publish VEX statements and pass them with --vex. Output SARIF (--format sarif) for code scanning dashboards or JSON for your own tooling.

Every day: treat the scanner as part of your supply chain

• Pin actions to full commit SHAs and let a bot propose updates you review, rather than referencing tags.
• Verify what you run: pull images by digest, and check signatures where the project publishes them.
• Limit what the scan job can reach. A scanner job rarely needs deployment credentials; give it a separate job with read-only tokens.
• If you ran an affected version, treat every secret the job could reach as exposed, rotate it, and search your organisation for repositories named tpcp-docs-*, which the advisory lists as a fallback exfiltration route.

Where it stops

• Installed, not running. An image scan tells you what packages exist, not which ones are loaded or reachable.
• Database freshness. An air-gapped scanner with a stale database reports yesterday's world.
• No fixes. Trivy reports; upgrades, base-image changes and pull requests are your pipeline's job.
• Experimental pieces. The YAML ignore file (.trivyignore.yaml) is marked experimental in the documentation.

How it comes up in interviews

• "Design an image scanning gate that does not block every release." Severity, fixability, expiry on exceptions, VEX and base-image ownership.
• "Your CI used trivy-action by tag during the March 2026 window. What do you do?" Scope the exposure window, rotate secrets, hunt for exfiltration, then pin and restrict.
• "Why is a security scanner a high-value target?" It runs in CI with access to source and secrets, often trusted without review.

Sources

Checked on 13 November 2026: Trivy documentation (targets and scanners, trivy image CLI reference, filtering, SBOM); aquasecurity/trivy GitHub README and releases; GitHub advisory GHSA-69fq-xp46-6x23 (CVE-2026-33634, published 21 March 2026); Aqua Security blog "Trivy supply chain attack: what you need to know" (22 March 2026, updated 1 April 2026); aquasecurity/trivy discussion #10425.