v0.76.1
2026-10-22T08:51:56Z•6b12f4ac54468ed38a9dd03a71a45237a2cb920aaa3bd38e7e45bfad9f5430bc
CVE-2026-111943AquasecurityCA-trust-storeGo-1.27.3Trivycertificate-authority-compromisecertificate-distrustcontainer-imageseMudhrasecurity-updatesupply-chain-security
What happened
Trivy v0.76.1 is a security update addressing the eMudhra intermediate certificate authority key compromise. Official binaries use Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943, while official container images update Alpine CA trust stores to reject affected certificate chains. Users should upgrade and redeploy, or rebuild from source with Go 1.27.3 or later and updated runtime CA certificates.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- aquasecurity_trivy_releases
- Record identifier
- 6b12f4ac54468ed38a9dd03a71a45237a2cb920aaa3bd38e7e45bfad9f5430bc
- Enrichment time
- 2026-10-22T08:51:56Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.