Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Can anyone confirm if the Ory github organization was impacted by the trivy vulnerability? I see trivy workflows were removed from the kratos repository on March 24th, but at that point the trivy jobs were compromised for 5 days. The newest releases were also released one day after the malicious trivy jobs went live.

I would like to confirm that the Ory team intentionally released v26.2.0 given that it occurred almost immediately after the malicious trivy workflows were released

Valid question!
I can confirm that it was an intentional release - will check with our security team if we have more info on how the Trivy compromise might or might not have affected us.

&gt; We investigated and confirmed we are not vulnerable. We ran Trivy in a separate GitHub Action with no access to secrets, so even if the affected version had executed, it would have had no impact.