Every CVE Search/ Get API key

CVE-2024-35192

Trivy possibly leaks registry credential when scanning images from malicious registries

5.5 MediumFix available

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.19%Up 0.1 points since May 21, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.5

Trivy possibly leaks registry credential when scanning images from malicious registries

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

Record
CVE-2024-35192
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
EUVDEUVD-2024-1860 5.5

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

Record
EUVD-2024-1860
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-xcq4-m2r3-cmrj 5.5

Trivy possibly leaks registry credential when scanning images from malicious registries

Impact

If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access.

Taking AWS as an example, the leakage only occurs when Trivy is able to transparently obtain registry credentials from the default credential provider chain. You are affected if Trivy is executed in any of the following situations:

  • The environment variables contain static AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) that have access to ECR.
  • Within a Pod running on an EKS cluster that has been assigned a role with access to ECR using an IAM Roles for Service Accounts (IRSA) annotation.
  • etc.

You are not affected if the default credential provider chain is unable to obtain valid credentials. The same applies to GCP and Azure.

Workarounds

If you are using Trivy v0.51.2 or later, you are not affected. If you are using Trivy v0.51.1 or prior, you should ensure you only scan images from trusted registries.

This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the --image-src flag to select which sources you trust.

Record
GHSA-xcq4-m2r3-cmrj
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
NVD 5.5

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

Record
CVE-2024-35192
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSV 5.5

Trivy possibly leaks registry credential when scanning images from malicious registries

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.

Record
CVE-2024-35192
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVGHSA-xcq4-m2r3-cmrj 5.5

Trivy possibly leaks registry credential when scanning images from malicious registries

Impact

If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access.

Taking AWS as an example, the leakage only occurs when Trivy is able to transparently obtain registry credentials from the default credential provider chain. You are affected if Trivy is executed in any of the following situations:

  • The environment variables contain static AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) that have access to ECR.
  • Within a Pod running on an EKS cluster that has been assigned a role with access to ECR using an IAM Roles for Service Accounts (IRSA) annotation.
  • etc.

You are not affected if the default credential provider chain is unable to obtain valid credentials. The same applies to GCP and Azure.

Workarounds

If you are using Trivy v0.51.2 or later, you are not affected. If you are using Trivy v0.51.1 or prior, you should ensure you only scan images from trusted registries.

This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the --image-src flag to select which sources you trust.

Record
GHSA-xcq4-m2r3-cmrj
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
Show 4 moreShow less
OSVGO-2024-2870 No score

Credential leakage in github.com/aquasecurity/trivy

A malicious registry can cause Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR) if the registry is scanned from directly using Trivy. These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the --image-src flag to select which sources you trust.

Record
GO-2024-2870
Updated
2026-11-02
OSVopenSUSE-SU-2024:0268-1 No score

Security update for trivy

trivy was updated to fix the following issues:

Update to version 0.54.1:

  • fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
  • fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
  • fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
  • docs: update ecosystem page reporting with plopsec.com app (#7262)
  • feat(vex): retrieve VEX attestations from OCI registries (#7249)
  • feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
  • refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
  • fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
  • chore: show VEX notice for OSS maintainers in CI environments (#7246)
  • feat(vuln): add --pkg-relationships (#7237)
  • docs: show VEX cli pages + update config file page for VEX flags (#7244)
  • fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
  • feat(vex): VEX Repository support (#7206)
  • fix(secret): skip regular strings contain secret patterns (#7182)
  • feat: share build-in rules (#7207)
  • fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
  • fix(cli): error on missing config file (#7154)
  • fix(secret): update length of hugging-face-access-token (#7216)
  • feat(sbom): add vulnerability support for SPDX formats (#7213)
  • fix(secret): trim excessively long lines (#7192)
  • chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
  • fix(server): pass license categories to options (#7203)
  • feat(mariner): Add support for Azure Linux (#7186)
  • docs: updates config file (#7188)
  • refactor(fs): remove unused field for CompositeFS (#7195)
  • fix: add missing platform and type to spec (#7149)
  • feat(misconf): enabled China configuration for ACRs (#7156)
  • fix: close file when failed to open gzip (#7164)
  • docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
  • docs(misconf): add info about limitations for terraform plan json (#7143)
  • chore: add VEX for Trivy images (#7140)
  • chore: add VEX document and generator for Trivy (#7128)
  • fix(misconf): do not evaluate TF when a load error occurs (#7109)
  • feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
  • refactor(secret): move warning about file size after IsBinary check (#7123)
  • feat: add openSUSE tumbleweed detection and scanning (#6965)
  • test: add missing advisory details for integration tests database (#7122)
  • fix: Add dependencyManagement exclusions to the child exclusions (#6969)
  • fix: ignore nodes when listing permission is not allowed (#7107)
  • fix(java): use go-mvn-version to remove Package duplicates (#7088)
  • refactor(secret): add warning about large files (#7085)
  • feat(nodejs): add license parser to pnpm analyser (#7036)
  • refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
  • feat: add log.FilePath() function for logger (#7080)
  • chore: bump golangci-lint from v1.58 to v1.59 (#7077)
  • perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
  • refactor: pass DB dir to trivy-db (#7057)
  • docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

  • feat(conda): add licenses support for environment.yml files (#6953)
  • fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
  • feat: add memory cache backend (#7048)
  • fix(sbom): use package UIDs for uniqueness (#7042)
  • feat(php): add installed.json file support (#4865)
  • docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
  • fix: use embedded when command path not found (#7037)
  • refactor: use google/wire for cache (#7024)
  • fix(cli): show info message only when --scanners is available (#7032)
  • chore:…
Record
openSUSE-SU-2024:0268-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0269-1 No score

Security update for trivy

trivy was updated to fix the following issues:

Update to version 0.54.1:

  • fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
  • fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
  • fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
  • release: v0.54.0 [main] (#7075)
  • docs: update ecosystem page reporting with plopsec.com app (#7262)
  • feat(vex): retrieve VEX attestations from OCI registries (#7249)
  • feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
  • refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
  • fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
  • chore: show VEX notice for OSS maintainers in CI environments (#7246)
  • feat(vuln): add --pkg-relationships (#7237)
  • docs: show VEX cli pages + update config file page for VEX flags (#7244)
  • fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
  • feat(vex): VEX Repository support (#7206)
  • fix(secret): skip regular strings contain secret patterns (#7182)
  • feat: share build-in rules (#7207)
  • fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
  • fix(cli): error on missing config file (#7154)
  • fix(secret): update length of hugging-face-access-token (#7216)
  • feat(sbom): add vulnerability support for SPDX formats (#7213)
  • fix(secret): trim excessively long lines (#7192)
  • chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
  • fix(server): pass license categories to options (#7203)
  • feat(mariner): Add support for Azure Linux (#7186)
  • docs: updates config file (#7188)
  • refactor(fs): remove unused field for CompositeFS (#7195)
  • fix: add missing platform and type to spec (#7149)
  • feat(misconf): enabled China configuration for ACRs (#7156)
  • fix: close file when failed to open gzip (#7164)
  • docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
  • docs(misconf): add info about limitations for terraform plan json (#7143)
  • chore: add VEX for Trivy images (#7140)
  • chore: add VEX document and generator for Trivy (#7128)
  • fix(misconf): do not evaluate TF when a load error occurs (#7109)
  • feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
  • refactor(secret): move warning about file size after IsBinary check (#7123)
  • feat: add openSUSE tumbleweed detection and scanning (#6965)
  • test: add missing advisory details for integration tests database (#7122)
  • fix: Add dependencyManagement exclusions to the child exclusions (#6969)
  • fix: ignore nodes when listing permission is not allowed (#7107)
  • fix(java): use go-mvn-version to remove Package duplicates (#7088)
  • refactor(secret): add warning about large files (#7085)
  • feat(nodejs): add license parser to pnpm analyser (#7036)
  • refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
  • feat: add log.FilePath() function for logger (#7080)
  • chore: bump golangci-lint from v1.58 to v1.59 (#7077)
  • perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
  • refactor: pass DB dir to trivy-db (#7057)
  • docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

  • release: v0.53.0 [main] (#6855)
  • feat(conda): add licenses support for environment.yml files (#6953)
  • fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
  • feat: add memory cache backend (#7048)
  • fix(sbom): use package UIDs for uniqueness (#7042)
  • feat(php): add installed.json file support (#4865)
  • docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
  • fix: use embedded when command path not found (#7037)
  • refactor: use google/wire for cache (#7024)
  • fix(cli): show…
Record
openSUSE-SU-2024:0269-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14030-1 No score

trivy-0.52.0-1.1 on GA media

These are all security issues fixed in the trivy-0.52.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14030-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/aquasecurity/trivy
Go
 before 0.51.2
0.51.2
trivy
SUSE:Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 0.54.1-bp155.2.3.1
0.54.1-bp155.2.3.1
trivy
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 0.54.1-bp155.2.3.1
0.54.1-bp155.2.3.1
trivy
SUSE:Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 0.54.1-bp156.2.3.1
0.54.1-bp156.2.3.1
trivy
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 0.54.1-bp156.2.3.1
0.54.1-bp156.2.3.1
trivy
openSUSE:Tumbleweed
 before 0.52.0-1.1
0.52.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-35192 is a medium vulnerability (CVSS 5.5) in Aquasecurity Trivy, published May 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in github.com/aquasecurity/trivy 0.51.2.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open