CISA Confirms: Your AI Security Scanner Got Backdoored. Federal Deadline Is April 8.

Two AI toolchain CVEs hit CISA's Known Exploited Vulnerabilities catalog this week, and the attack chain connecting them is the kind of thing that should change how you think about supply chain trust.

CVE-2026-33017: Langflow, the popular agent workflow builder, has an unauthenticated remote code execution vulnerability in v1.8.2 and earlier. No login required. Full server access. It was exploited in the wild within 20 hours of the advisory being published on March 17. Twenty hours. If you're running Langflow and didn't patch within a day, assume compromise.

CVE-2026-33634: This is the Trivy supply chain compromise, and the attack chain is worth understanding in detail. On March 19, attacker "TeamPCP" force-pushed 75 of 76 tags on the trivy-action GitHub Action, replacing legitimate binaries with versions that exfiltrated AWS, GCP, and Azure credentials, SSH keys, and Kubernetes tokens. Trivy is Aqua Security's vulnerability scanner. The tool designed to find security problems was the attack vector.

The cascade didn't stop at Trivy. The compromised credentials from Trivy's CI/CD pipeline were used to backdoor LiteLLM on PyPI. Wiz reported that the LiteLLM compromise affected 36% of cloud environments they monitor. More than a third.

AppSec Santa's RSAC analysis adds a gut-punch detail: 71% of organizations never pin their GitHub Actions to commit hashes. That means nearly three-quarters of all CI/CD pipelines are vulnerable to exactly this kind of tag-mutation attack right now. And this was the second Trivy compromise in March. The first happened March 1. The root cause of the second was incomplete credential rotation after the first. They patched the code but didn't rotate all the lateral credentials, and the attackers walked back in through the gap.

Federal agencies have an April 8-9 remediation deadline. For everyone else, the deadline was March 19, the day it happened.

For builders: pin every GitHub Action to full commit SHAs today. Not tomorrow. Today. Replace uses: aquasecurity/[redacted] with the full SHA. Audit your CI/CD pipeline for any action that isn't pinned. Then check if you're using LiteLLM, and if so, verify you're on a clean version. If you ran Langflow before March 17, audit your server for unauthorized access.

The pattern is what scares me. Attackers aren't going after your code. They're going after the tools you trust to check your code. And 71% of us aren't even using the basic mitigation that would have stopped this.