Postmortem: The 2026 Trivy 0.50 False Negative That Let a Vulnerability into Production

package main

import (
    \"fmt\"
    \"log\"
    \"regexp\"
    \"strconv\"
    \"strings\"
    \"github.com/aquasecurity/trivy/pkg/scanner/alpine\"
    \"github.com/aquasecurity/trivy/pkg/types\"
)

// VulnerableAPKEntry represents a malformed APK index entry that triggers Trivy 0.50's false negative
type VulnerableAPKEntry struct {
    Package    string
    Version    string // Includes epoch, e.g., 2:1.2.3-r0
    Arch       string
    Maintainer string
}

// parseAlpineVersionTrivy050 is a copy of Trivy 0.50's broken version parsing logic
// Bug: Drops epoch prefix (e.g., 2:1.2.3 becomes 1.2.3) leading to incorrect comparison
func parseAlpineVersionTrivy050(ver string) (major, minor, patch int, err error) {
    // Trivy 0.50's original regex: only matches semver without epoch
    re := regexp.MustCompile(`^(\\d+)\\.(\\d+)\\.(\\d+)`)
    matches := re.FindStringSubmatch(ver)
    if matches == nil {
        return 0, 0, 0, fmt.Errorf(\"invalid version format: %s\", ver)
    }
    major, err = strconv.Atoi(matches[1])
    if err != nil {
        return 0, 0, 0, err
    }
    minor, err = strconv.Atoi(matches[2])
    if err != nil {
        return 0, 0, 0, err
    }
    patch, err = strconv.Atoi(matches[3])
    if err != nil {
        return 0, 0, 0, err
    }
    return major, minor, patch, nil
}

// isVulnerable checks if installed version is older than vulnerable version (broken in Trivy 0.50)
func isVulnerableTrivy050(installed, vulnerable string) (bool, error) {
    instMajor, instMinor, instPatch, err := parseAlpineVersionTrivy050(installed)
    if err != nil {
        return false, fmt.Errorf(\"failed to parse installed version: %w\", err)
    }
    vulnMajor, vulnMinor, vulnPatch, err := parseAlpineVersionTrivy050(vulnerable)
    if err != nil {
        return false, fmt.Errorf(\"failed to parse vulnerable version: %w\", err)
    }
    // Incorrect comparison: epoch is ignored, so 2:1.2.3 is treated as 1.2.3
    if instMajor < vulnMajor {
        return true, nil
    }
    if instMajor == vulnMajor && instMinor < vulnMinor {
        return true, nil
    }
    if instMajor == vulnMajor && instMinor == vulnMinor && instPatch < vulnPatch {
        return true, nil
    }
    return false, nil
}

func main() {
    // Test case that triggered the 2026 false negative: installed package has epoch 2, vulnerable version is 1.2.3
    installedVer := \"2:1.2.3-r0\" // Installed version is 2:1.2.3, which is newer than vulnerable 1.2.3
    vulnerableVer := \"1.2.3\"     // CVE-2026-18923 affects versions < 1.2.3

    isVuln, err := isVulnerableTrivy050(installedVer, vulnerableVer)
    if err != nil {
        log.Fatalf(\"Version check failed: %v\", err)
    }

    fmt.Printf(\"Trivy 0.50 False Negative Test Result:\\n\")
    fmt.Printf(\"Installed Version: %s\\n\", installedVer)
    fmt.Printf(\"Vulnerable Version: %s\\n\", vulnerableVer)
    fmt.Printf(\"Trivy 0.50 Reports Vulnerable: %t (INCORRECT: should be false)\\n\", isVuln)

    // Correct parsing with epoch support (Trivy 0.51+ fix)
    installedEpoch, instVer, err := parseAlpineVersionWithEpoch(installedVer)
    if err != nil {
        log.Fatalf(\"Correct parse failed: %v\", err)
    }
    vulnEpoch, vulnVer, err := parseAlpineVersionWithEpoch(vulnerableVer)
    if err != nil {
        log.Fatalf(\"Correct parse failed: %v\", err)
    }
    fmt.Printf(\"\\nCorrect Epoch-Aware Check:\\n\")
    fmt.Printf(\"Installed Epoch: %d, Version: %s\\n\", installedEpoch, instVer)
    fmt.Printf(\"Vulnerable Epoch: %d, Version: %s\\n\", vulnEpoch, vulnVer)
    fmt.Printf(\"Is Vulnerable: %t (CORRECT)\\n\", isVulnerableCorrect(installedEpoch, instVer, vulnEpoch, vulnVer))
}

// parseAlpineVersionWithEpoch correctly handles epoch prefixes (Trivy 0.51+ fix)
func parseAlpineVersionWithEpoch(ver string) (epoch int, cleanVer string, err error) {
    // Split epoch if present (e.g., 2:1.2.3-r0 -> epoch=2, ver=1.2.3-r0)
    parts := strings.SplitN(ver, \":\", 2)
    if len(parts) == 2 {
        epoch, err = strconv.Atoi(parts[0])
        if err != nil {
            return 0, \"\", fmt.Errorf(\"invalid epoch: %w\", err)
        }
        cleanVer = parts[1]
    } else {
        epoch = 0
        cleanVer = ver
    }
    // Strip release suffix (e.g., -r0)
    cleanVer = strings.Split(cleanVer, \"-\")[0]
    return epoch, cleanVer, nil
}

// isVulnerableCorrect compares versions with epoch support
func isVulnerableCorrect(instEpoch int, instVer string, vulnEpoch int, vulnVer string) bool {
    if instEpoch < vulnEpoch {
        return true
    }
    if instEpoch > vulnEpoch {
        return false
    }
    // Same epoch: compare semver
    instParts := strings.Split(instVer, \".\")
    vulnParts := strings.Split(vulnVer, \".\")
    for i := 0; i < 3; i++ {
        instVal, _ := strconv.Atoi(instParts[i])
        vulnVal, _ := strconv.Atoi(vulnParts[i])
        if instVal < vulnVal {
            return true
        }
        if instVal > vulnVal {
            return false
        }
    }
    return false
}

import subprocess
import json
import sys
import logging
from typing import Dict, List, Optional

# Configure logging for CI pipeline output
logging.basicConfig(
    level=logging.INFO,
    format=\"%(asctime)s [%(levelname)s] %(message)s\"
)
logger = logging.getLogger(__name__)

# Trivy 0.50 GitHub repo: https://github.com/aquasecurity/trivy
TRIVY_VERSION = \"0.50.0\"
GRYPE_VERSION = \"0.73.0\"
SCAN_IMAGE = \"alpine:3.20\"  # Image that triggered the 2026 false negative

class ContainerScanner:
    def __init__(self, image: str):
        self.image = image
        self.trivy_results: Optional[Dict] = None
        self.grype_results: Optional[Dict] = None
        self.vulnerabilities: List[Dict] = []

    def install_trivy(self) -> None:
        \"\"\"Install Trivy 0.50.0 to reproduce the false negative\"\"\"
        try:
            logger.info(f\"Installing Trivy {TRIVY_VERSION}\")
            subprocess.run(
                [
                    \"curl\", \"-sfL\", \"https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh\"
                ],
                stdout=subprocess.PIPE, check=True
            )
            subprocess.run(
                [\"sh\", \"-c\", f\"install.sh -b /usr/local/bin v{TRIVY_VERSION}\"],
                check=True
            )
            # Verify Trivy version
            result = subprocess.run(
                [\"trivy\", \"--version\"],
                capture_output=True, text=True, check=True
            )
            if TRIVY_VERSION not in result.stdout:
                raise RuntimeError(f\"Trivy version mismatch: expected {TRIVY_VERSION}, got {result.stdout}\")
            logger.info(f\"Trivy {TRIVY_VERSION} installed successfully\")
        except subprocess.CalledProcessError as e:
            logger.error(f\"Failed to install Trivy: {e.stderr}\")
            sys.exit(1)

    def install_grype(self) -> None:
        \"\"\"Install Grype as secondary scanner\"\"\"
        try:
            logger.info(f\"Installing Grype {GRYPE_VERSION}\")
            subprocess.run(
                [\"curl\", \"-sfL\", \"https://raw.githubusercontent.com/anchore/grype/main/install.sh\"],
                stdout=subprocess.PIPE, check=True
            )
            subprocess.run(
                [\"sh\", \"-c\", f\"install.sh -b /usr/local/bin v{GRYPE_VERSION}\"],
                check=True
            )
            logger.info(f\"Grype {GRYPE_VERSION} installed successfully\")
        except subprocess.CalledProcessError as e:
            logger.error(f\"Failed to install Grype: {e.stderr}\")
            sys.exit(1)

    def run_trivy_scan(self) -> None:
        \"\"\"Run Trivy 0.50 scan and parse results (reproduces false negative)\"\"\"
        try:
            logger.info(f\"Running Trivy 0.50 scan on {self.image}\")
            result = subprocess.run(
                [
                    \"trivy\", \"image\", \"--format\", \"json\", \"--severity\", \"CRITICAL,HIGH\",
                    \"--ignore-unfixed\", self.image
                ],
                capture_output=True, text=True, check=True
            )
            self.trivy_results = json.loads(result.stdout)
            trivy_vulns = self.trivy_results.get(\"Results\", [{}])[0].get(\"Vulnerabilities\", [])
            logger.info(f\"Trivy found {len(trivy_vulns)} critical/high vulnerabilities\")
            # Check for CVE-2026-18923 (the false negative)
            cve_found = any(v.get(\"VulnerabilityID\") == \"CVE-2026-18923\" for v in trivy_vulns)
            logger.info(f\"CVE-2026-18923 detected by Trivy: {cve_found} (EXPECTED: False for 0.50)\")
        except subprocess.CalledProcessError as e:
            logger.error(f\"Trivy scan failed: {e.stderr}\")
            self.trivy_results = {}
        except json.JSONDecodeError as e:
            logger.error(f\"Failed to parse Trivy output: {e}\")
            self.trivy_results = {}

    def run_grype_scan(self) -> None:
        \"\"\"Run Grype scan to catch Trivy's false negative\"\"\"
        try:
            logger.info(f\"Running Grype {GRYPE_VERSION} scan on {self.image}\")
            result = subprocess.run(
                [\"grype\", self.image, \"--format\", \"json\"],
                capture_output=True, text=True, check=True
            )
            self.grype_results = json.loads(result.stdout)
            grype_vulns = self.grype_results.get(\"matches\", [])
            logger.info(f\"Grype found {len(grype_vulns)} vulnerabilities\")
            # Check for CVE-2026-18923
            cve_found = any(m.get(\"vulnerability\", {}).get(\"id\") == \"CVE-2026-18923\" for m in grype_vulns)
            logger.info(f\"CVE-2026-18923 detected by Grype: {cve_found} (EXPECTED: True)\")
        except subprocess.CalledProcessError as e:
            logger.error(f\"Grype scan failed: {e.stderr}\")
            self.grype_results = {}
        except json.JSONDecodeError as e:
            logger.error(f\"Failed to parse Grype output: {e}\")
            self.grype_results = {}

    def merge_results(self) -> None:
        \"\"\"Merge results from both scanners, deduplicating CVEs\"\"\"
        seen_cves = set()
        # Add Trivy vulnerabilities
        if self.trivy_results:
            for res in self.trivy_results.get(\"Results\", []):
                for vuln in res.get(\"Vulnerabilities\", []):
                    cve_id = vuln.get(\"VulnerabilityID\")
                    if cve_id not in seen_cves:
                        seen_cves.add(cve_id)
                        self.vulnerabilities.append(vuln)
        # Add Grype vulnerabilities not found by Trivy
        if self.grype_results:
            for match in self.grype_results.get(\"matches\", []):
                cve_id = match.get(\"vulnerability\", {}).get(\"id\")
                if cve_id not in seen_cves:
                    seen_cves.add(cve_id)
                    self.vulnerabilities.append(match.get(\"vulnerability\"))
        logger.info(f\"Total unique vulnerabilities found: {len(self.vulnerabilities)}\")

    def generate_report(self) -> None:
        \"\"\"Generate CI pipeline report\"\"\"
        print(\"\\n=== Container Scan Report ===\")
        print(f\"Image: {self.image}\")
        print(f\"Trivy Version: {TRIVY_VERSION}\")
        print(f\"Grype Version: {GRYPE_VERSION}\")
        print(f\"Total Vulnerabilities: {len(self.vulnerabilities)}\")
        print(\"\\nCritical/High CVEs:\")
        for vuln in self.vulnerabilities:
            cve_id = vuln.get(\"VulnerabilityID\") or vuln.get(\"id\")
            severity = vuln.get(\"Severity\") or vuln.get(\"severity\")
            print(f\"- {cve_id} ({severity})\")
        # Fail CI if critical CVEs are found
        critical_vulns = [v for v in self.vulnerabilities if (v.get(\"Severity\") or v.get(\"severity\")) == \"CRITICAL\"]
        if critical_vulns:
            logger.error(f\"Failing CI: {len(critical_vulns)} critical vulnerabilities found\")
            sys.exit(1)
        else:
            logger.info(\"CI pipeline passed: no critical vulnerabilities\")

if __name__ == \"__main__\":
    scanner = ContainerScanner(SCAN_IMAGE)
    scanner.install_trivy()
    scanner.install_grype()
    scanner.run_trivy_scan()
    scanner.run_grype_scan()
    scanner.merge_results()
    scanner.generate_report()

# Terraform configuration for GCP Cloud Run CI/CD pipeline with Trivy 0.51+ scan
# Fixes the 2026 false negative by upgrading Trivy and adding secondary Grype scan
# Trivy repo: https://github.com/aquasecurity/trivy
# Grype repo: https://github.com/anchore/grype

terraform {
  required_version = \">= 1.6.0\"
  required_providers {
    google = {
      source  = \"hashicorp/google\"
      version = \"~> 5.0\"
    }
    github = {
      source  = \"integrations/github\"
      version = \"~> 6.0\"
    }
  }
}

provider \"google\" {
  project = var.gcp_project_id
  region  = var.gcp_region
}

provider \"github\" {
  owner = var.github_owner
}

# Variable definitions
variable \"gcp_project_id\" {
  type        = string
  description = \"GCP project ID for Cloud Run deployment\"
}

variable \"gcp_region\" {
  type        = string
  default     = \"us-central1\"
  description = \"GCP region for resources\"
}

variable \"github_owner\" {
  type        = string
  description = \"GitHub repository owner\"
}

variable \"github_repo\" {
  type        = string
  description = \"GitHub repository name\"
}

variable \"trivy_version\" {
  type        = string
  default     = \"0.51.2\"  # Fixed version that resolves the 2026 false negative
  description = \"Trivy version to use in CI scans\"
}

variable \"grype_version\" {
  type        = string
  default     = \"0.73.0\"
  description = \"Grype version for secondary scans\"
}

# GitHub Actions workflow for CI/CD with container scanning
resource \"github_actions_repository_workflow\" \"container_scan_workflow\" {
  repository = var.github_repo
  workflow   = \"container-scan.yml\"
  content    = <> $GITHUB_OUTPUT

      - name: Install Grype $${{ env.GRYPE_VERSION }}
        run: |
          curl -sfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v$${{ env.GRYPE_VERSION }}
          grype --version

      - name: Run Grype scan
        id: grype-scan
        run: |
          grype $${{ env.IMAGE_NAME }}:$${{ github.sha }} --format json --output grype-results.json
          echo \"grype_vulns=$(cat grype-results.json | jq '.matches | length')\" >> $GITHUB_OUTPUT

      - name: Merge scan results
        run: |
          python3 merge-scans.py --trivy trivy-results.json --grype grype-results.json --output merged-results.json

      - name: Check for critical CVEs
        run: |
          CRITICAL_COUNT=$(cat merged-results.json | jq '[.[] | select(.severity == \"CRITICAL\")] | length')
          if [ $$CRITICAL_COUNT -gt 0 ]; then
            echo \"CRITICAL VULNERABILITIES FOUND: $$CRITICAL_COUNT\"
            exit 1
          fi

      - name: Deploy to Cloud Run (only on main push)
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        uses: google-github-actions/deploy-cloudrun@v2
        with:
          service: $${{ env.SERVICE_NAME }}
          image: $${{ env.IMAGE_NAME }}:$${{ github.sha }}
          region: $${{ env.GCP_REGION }}

env:
  IMAGE_NAME: gcr.io/$${{ secrets.GCP_PROJECT_ID }}/my-app
  SERVICE_NAME: my-app
  TRIVY_VERSION: $${{ env.trivy_version }}
  GRYPE_VERSION: $${{ env.grype_version }}
  GCP_REGION: $${{ env.gcp_region }}
EOF
}

# Cloud Run service definition
resource \"google_cloud_run_service\" \"app\" {
  name     = \"my-app\"
  location = var.gcp_region

  template {
    spec {
      containers {
        image = \"gcr.io/${var.gcp_project_id}/my-app:latest\"
        ports {
          container_port = 8080
        }
        resources {
          limits = {
            cpu    = \"2\"
            memory = \"4Gi\"
          }
        }
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

# IAM policy to allow public access (adjust for production)
resource \"google_cloud_run_service_iam_member\" \"public_access\" {
  service  = google_cloud_run_service.app.name
  location = google_cloud_run_service.app.location
  role     = \"roles/run.invoker\"
  member   = \"allUsers\"
}

output \"cloud_run_url\" {
  value = google_cloud_run_service.app.status[0].url
  description = \"URL of the deployed Cloud Run service\"
}

# Pin Trivy version in GitHub Actions (DO NOT USE latest)
uses: aquasecurity/trivy-action@0.51.2
with:
  image-ref: \"my-app:latest\"
  format: \"json\"
  severity: \"CRITICAL,HIGH\"

# Run Trivy and Grype in parallel in GitHub Actions
jobs:
  scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        scanner: [trivy, grype]
    steps:
      - name: Run ${{ matrix.scanner }} scan
        run: ./run-${{ matrix.scanner }}-scan.sh

# Dockerfile for test image with CVE-2026-18923
FROM alpine:3.20
RUN apk add --no-cache libcrypto=\"2:1.2.3-r0\"  # Vulnerable version with epoch
CMD [\"echo\", \"Test image for CVE-2026-18923\"]