Notifications
Clear all
Topic starter
06/06/2026 11:21 am
TL;DR: The compromise of Aqua Security’s Trivy showed two failure modes at once: supply chain trust and credential architecture, with an attacker using a GitHub Actions PAT to publish malicious scanner versions that harvested AWS, GCP, Azure, and Kubernetes credentials from pipelines, according to Aembit. The deeper lesson is that static secrets turn a single tool compromise into a scalable NHI harvest, which makes workload identity a structural control issue, not a tuning exercise.
NHIMG editorial — based on content published by Aembit: analysis of the Trivy compromise and its credential exposure lessons
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: What breaks when build pipelines still rely on long-lived machine credentials?
A: A compromised build step can read and reuse the same credentials that were meant to support automation, which turns one trusted runtime into a secret-harvesting point.
Q: Why do secrets managers not fully solve credential theft in CI/CD?
A: Secrets managers reduce handling friction, but they do not remove the secret from the environment where code runs.
Q: What do security teams get wrong about workload identity for pipelines?
A: They sometimes treat it as a way to manage secrets better, when the real value is eliminating stored secrets from the workflow entirely.
Practitioner guidance
- Remove long-lived machine credentials from pipeline runtimes Replace stored tokens in GitHub Actions and similar systems with attested workload identity and just-in-time credential issuance so build steps never see durable secrets.
- Pin and verify every build artifact Require immutable digests, artifact signing, and signature verification before a job can execute third-party tooling or pull mutable tags into a trusted pipeline.
- Segregate high-value cloud and Kubernetes access Split pipeline permissions so a compromised scanner cannot reach broad AWS, GCP, Azure, or Kubernetes service account scopes from the same runtime context.
What's in the full article
Aembit’s full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of the malicious GitHub Actions workflow path that enabled the initial PAT abuse.
- Specific examples of the AWS, GCP, Azure, and Kubernetes credential types the attacker harvested from pipelines.
- The workload identity and attestation model used to replace stored secrets with short-lived access.
- The distinction between artifact verification controls and credential architecture controls in the same incident.
👉 Read Aembit’s analysis of the Trivy compromise and machine credential exposure →
Trivy compromise and the credential architecture gap teams miss?
Explore further
06/06/2026 12:05 pm
Credential architecture, not just supply chain trust, was the real scaling factor in the Trivy incident. The attack became severe because the malicious scanner found long-lived machine credentials inside the environments it touched. That means the blast radius was created by persistent NHI exposure, not merely by a bad package release. Practitioners should treat this as a credential design failure, not only an integrity failure.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
A question worth separating out:
Q: Who is accountable when a trusted scanner harvests cloud credentials from pipelines?
A: Accountability sits with the teams that own pipeline identity, secret placement, and artifact trust, not with any single tool. Frameworks such as NIST CSF and OWASP NHI both point to governance, access control, and detection as shared responsibilities across build, cloud, and identity teams.
👉 Read our full editorial: Trivy compromise shows why credential architecture failed at scale
