A Compromised Trivy Update Led to a European Commission Cloud Breach
The European Commission used a compromised version of a trusted security scanner. The resulting breach shows that build tools can become credential-harvesting infrastructure inside the systems they are meant to protect.
CERT-EU published its investigation into a European Commission cloud breach on 2 April. It assessed with high confidence that initial access came through the supply-chain compromise of Trivy, an open-source vulnerability scanner maintained by Aqua Security.
On 19 March, a malicious actor obtained an AWS secret exposed to the compromised tool. The key had management rights and was used to create another access key, conduct reconnaissance and search for additional credentials. The Commission detected abnormal Amazon API activity and network traffic on 24 March, then revoked the compromised access.
About 91.7 GB of compressed data was exfiltrated. CERT-EU confirmed personal data including names, usernames, email addresses and some email content. The affected AWS environment supported Europa web-hosting clients inside the Commission and at least 29 other EU entities. The Commission said its internal systems were not affected, and CERT-EU found no website tampering or service interruption.
Security tools sit inside the trust boundary
A scanner needs broad visibility to find vulnerabilities and misconfigurations. In a CI/CD pipeline, it may inspect files, container images, build output and cloud configuration. If the scanner’s update path is compromised, those legitimate permissions become attacker capabilities.
The incident is an important correction to a common risk model. Security software is not automatically a trusted exception; it is a high-value dependency whose publisher, release process and runtime access need independent control.
Rotate what the tool could see
Updating Trivy removes the malicious version but does not invalidate credentials already copied. CERT-EU advised organisations to identify every affected deployment and rotate AWS credentials and other secrets that may have been accessible during the compromise window.
The response should include:
- inventory Trivy versions across developer systems, runners and reusable workflows;
- isolate builds that used an affected release and preserve their logs;
- rotate exposed cloud, registry and deployment credentials;
- search for unusual STS calls, TruffleHog execution and new access keys;
- review outbound connections to unexpected domains, repositories and tunnels;
- examine whether a stolen key could reach other accounts or organisations.
CloudTrail and organisation-level logs should be retained outside the account an attacker can administer.
Replace mutable trust with verifiable releases
Pin GitHub Actions and other pipeline dependencies to full commit hashes rather than mutable tags. Verify signatures or provenance where available and maintain an inventory of build-time tools, not only application libraries.
Pinning is not enough if nobody reviews updates. A controlled process should compare the new release, publisher and provenance before the pinned reference changes. Privileged release workflows should also run on isolated, short-lived runners with minimal network access.
Most importantly, avoid placing long-lived cloud keys in a scanner’s environment. Use workload identity and short-lived credentials restricted to the exact account, resource and action required. A scanner that only needs read access should not receive permission to create access keys.
Detection closed the gap (but after exfiltration)
The Commission’s alerts identified abnormal API use and traffic, enabling containment. The volume already removed shows why pipeline monitoring must operate in real time.
Alert on security tools making unexpected network connections, reading unrelated secrets or performing cloud-management actions. A trusted process behaving outside its purpose should be investigated like any other anomaly.
The enduring lesson is simple: every trusted update channel is part of the attack surface, including the one delivering the security scanner.
