Topic starter
21/08/2026 4:52 pm
TL;DR: Trivy was hit by two supply chain attacks in March 2026, with the first stealing a privileged GitHub token through a dangerous pull_request_target workflow and the second reusing incomplete rotation to poison releases, tags, and downstream packages, according to ARMO. The pattern shows that CI/CD trust, not just code integrity, is now the governing control point for open-source consumers.
Editorial analysis by NHI Mgmt Group, based on content published by ARMO: “When Your Friend’s House Burns Down Twice: The Trivy Supply Chain Attacks Explained”.
Key questions
Q: What breaks when pull_request_target workflows process untrusted input?
A: The workflow can turn attacker-controlled text or branch names into executable shell syntax while still running with the base repository's permissions.
Q: Why do compromised CI/CD credentials make supply chain attacks much worse?
A: CI/CD credentials often sit at the centre of publish, build, and deployment workflows, so one stolen token can reach many repositories and environments.
Q: How do teams know whether release integrity controls are actually working?
A: They should look for consistent automated coverage across signing, security checks, SBOM generation, and image signing, not just policy documents.
Practitioner guidance
- Harden privileged GitHub Actions workflows Reserve pull_request_target for the smallest possible read-only checks and forbid execution of fork-supplied code in jobs that can access secrets or write permissions.
- Protect release tags and provenance Lock down mutable tags, require signed release provenance, and verify that consumed artefacts still match the approved commit and author chain.
- Treat CI/CD tokens as coordinated NHI assets Inventory PATs, service accounts, registry credentials, and cloud keys used by build and release automation, then revoke old values atomically during incident response.
Bottom line: The Trivy compromise revealed that CI/CD workflows, release tags, and pipeline tokens can act as privileged identities with their own lifecycle risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:10 pm
CI/CD workflows now behave like non-human identities with their own lifecycle risk. The Trivy compromise shows that build jobs, release pipelines, and automated tokens are not just delivery plumbing. They are governed access paths with scope, revocation, and trust boundaries. Once those boundaries blur, the pipeline itself becomes the attacker’s identity layer, and practitioners should treat CI/CD credentials as first-class NHI assets.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do after a CI/CD token or PAT is exposed?
A: Revoke the exposed token, invalidate any related sessions or cached secrets, and assume adjacent credentials may also be compromised. Then inspect release jobs, runners, package publishing paths, and downstream repositories for misuse. The goal is to collapse attacker access across the whole workflow chain before further tag, release, or package poisoning can occur.
👉 Read our full editorial: Trivy’s twin supply chain attacks expose CI/CD credential fragility