openSUSE Trivy Security Update (CVE-2026-72815/72816/72817): Patching and Hardening Guide for Your Container Scanning Pipeline

---
title: Trivy Scanner Spawning Suspicious Child Processes
id: 3f9c2a71-8b4d-4e6a-b512-9d1e7f3a6c20
status: experimental
description: Detects the Trivy scanner process spawning shells, script interpreters, or system utilities — behavior consistent with exploitation of a parsing vulnerability or a tampered scanner binary. Trivy should not spawn interactive shells or interpreters in normal operation.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0312-1-trivy
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/trivy'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Wrapper scripts that invoke trivy and shell commands in the same pipeline step (verify parent/child relationship)
level: high
---
title: Trivy Writing Files Outside Expected Cache and Report Paths
id: 7b1e4d92-3c6f-4a58-9e21-2f8c6b0d5a43
status: experimental
description: Detects the Trivy process creating files in sensitive system locations such as cron directories, systemd unit paths, SSH authorized_keys, or profile scripts — a strong indicator of post-exploitation persistence following scanner compromise.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0312-1-trivy
  - https://attack.mitre.org/techniques/T1053/
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1543.002
logsource:
  category: file_event
  product: linux
detection:
  selection_image:
    Image|endswith: '/trivy'
  selection_paths:
    TargetFilename|contains:
      - '/etc/cron'
      - '/etc/systemd/system/'
      - '/.ssh/authorized_keys'
      - '/etc/profile.d/'
      - '/etc/rc.local'
      - '/var/spool/cron'
  condition: selection_image and selection_paths
falsepositives:
  - None expected; Trivy has no legitimate reason to write to persistence locations
level: critical
---
title: Trivy Network Connection to Unrelated External Host
id: 5c8a2f14-6d3b-4e79-a145-8c2d9e4f7b61
status: experimental
description: Flags Trivy initiating outbound connections to destinations other than known vulnerability database mirrors, container registries, or internal artifact repositories — possible C2 or data exfiltration following exploitation. Baseline your registry and DB endpoints before deployment.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0312-1-trivy
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/trivy'
  filter_known:
    DestinationHostname|contains:
      - 'ghcr.io'
      - 'github.com'
      - 'aquasecurity.github.io'
      - '.amazonaws.com'
  condition: selection and not filter_known
falsepositives:
  - Private container registries and internal mirrors — add them to the allowlist before enabling
level: medium

// Hunt for suspicious Trivy process behavior in Microsoft Sentinel (Syslog/CEF ingestion from Linux hosts)
// Looks for trivy spawning shells/interpreters or being executed from unusual paths
union isfuzzy=true
    (Syslog
    | where Facility =~ "user" or Facility =~ "daemon"
    | where ProcessName =~ "trivy" or SyslogMessage has "trivy"
    | where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "perl", "curl", "wget", "nc ", "chmod +x", "/etc/cron", "authorized_keys")
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage),
    (CommonSecurityLog
    | where DeviceProcessName has "trivy"
    | where AdditionalExtensions has_any ("cron", "authorized_keys", "systemd", "bash", "curl", "wget")
    | project TimeGenerated, SourceIP, DestinationHostName, DeviceProcessName, AdditionalExtensions)
| order by TimeGenerated desc

// Secondary hunt: inventory where trivy executes from and flag non-standard install paths
Syslog
| where SyslogMessage has "trivy"
| extend ExecPath = extract(@"((/|~/)[\w\./-]*trivy)", 1, SyslogMessage)
| where ExecPath !startswith "/usr" and ExecPath !startswith "/snap" and ExecPath !startswith "/opt"
| summarize ExecutionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ExecPath
| order by FirstSeen desc

-- Hunt Trivy execution artifacts and anomalous scanner behavior across Linux endpoints
-- 1) Locate running trivy processes with full command lines and parent context
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'trivy'
   OR CommandLine =~ 'trivy'

-- 2) Identify trivy binaries in non-standard locations (dropped/tampered copies)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/tmp/**/trivy', '/var/tmp/**/trivy', '/dev/shm/**/trivy', '/home/*/**/trivy'])

-- 3) Review active network connections held by trivy processes for unexpected destinations
SELECT Pid, Name, Status, RemoteIP, RemotePort, LocalIP, LocalPort
FROM netstat()
WHERE Name =~ 'trivy'
  AND Status =~ 'ESTABLISHED'

#!/bin/bash
# Security Arsenal - Trivy remediation & verification script for openSUSE (advisory openSUSE-2026-0312-1)
# Addresses CVE-2026-72815, CVE-2026-72816, CVE-2026-72817
# Run as root on each openSUSE host running the Trivy package.

set -euo pipefail

echo "=== [1] Current installed Trivy version ==="
rpm -q trivy 2>/dev/null || echo "trivy package not installed via rpm"
if command -v trivy &>/dev/null; then
    trivy --version
fi

echo "=== [2] Refresh repositories and apply the security update ==="
zypper refresh
zypper patch --category security --with-interactive || zypper update trivy

echo "=== [3] Verify updated package ==="
rpm -q trivy --changelog | head -n 30

echo "=== [4] Check for non-package Trivy binaries (containers, manual installs, CI caches) ==="
find / -xdev -type f -name "trivy" -executable 2>/dev/null | while read -r bin; do
    echo "Found: $bin"
    "$bin" --version 2>/dev/null || echo "  (version check failed — investigate)"
done

echo "=== [5] Audit Trivy container images in use (CI/CD, Kubernetes operator) ==="
if command -v docker &>/dev/null; then
    docker images --format '{{.Repository}}:{{.Tag}}' | grep -i trivy || echo "No local trivy images"
fi
if command -v kubectl &>/dev/null; then
    kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{" "}{.spec.containers[*].image}{"\n"}{end}' 2>/dev/null | grep -i trivy || echo "No trivy pods detected"
fi

echo "=== [6] Review Trivy server/operator exposure ==="
ss -tlnp 2>/dev/null | grep -i trivy || echo "No trivy listener bound"

echo "=== [7] Harden: confirm Trivy runs unprivileged and DB cache is intact ==="
ps aux | grep -i [t]rivy || echo "No trivy processes currently running"

echo ""
echo "REMEDIATION COMPLETE. Verify version against openSUSE-2026-0312-1 and update CI/CD image pins."