Security researchers from Wiz identified a critical vulnerability in AWS CodeBuild that highlighted significant risks in the software supply chain security landscape. Dubbed ‘CodeBreach,’ this flaw stemmed from improper use of regex patterns in webhook filters, missing essential start (^) and end ($) anchors. This misconfiguration allowed unauthorized users to infiltrate AWS GitHub repositories by creating GitHub accounts with IDs that matched those of trusted maintainers, thus bypassing access controls.
The specific issue lay in the regex filter used to hide secrets in build logs, which failed to adequately capture actor IDs due to two missing characters. This oversight enabled attackers to infiltrate build environments and potentially steal credentials, posing a risk to major AWS environments and repositories, including the AWS SDK for JavaScript v3. Researchers demonstrated the vulnerability’s potential impact on the global software supply chain, which could have affected a large fraction of Fortune 500 companies that utilize AWS services.
Upon disclosure of the vulnerability in August 2025, AWS acted swiftly, patching the issue within 48 hours and implementing global hardening measures to enhance security in its continuous integration and continuous deployment (CI/CD) pipelines. No customer environments were compromised as a result of this vulnerability; however, the incident underscores the importance of maintaining robust CI/CD security practices.
To mitigate similar risks in the future, it is recommended that developers enforce strict safeguards such as pull request approval gates, the use of fine-grained access tokens, and properly anchored regex patterns in webhook filters. This event serves as a crucial reminder of the persistent vulnerabilities within CI/CD systems and the need for comprehensive security strategies in modern software development.

Collections

Security researchers discovered a critical vulnerability in AWS CodeBuild called 'CodeBreach' that allowed unauthorized access to AWS GitHub repositories through improperly anchored regex patterns in webhook filters. Attackers could create GitHub accounts matching trusted maintainer IDs to bypass access controls and potentially steal credentials from build environments. AWS patched the vulnerability within 48 hours of disclosure in August 2025, with no customer environments compromised. The incident highlights the importance of implementing strict CI/CD security practices including pull request approval gates, fine-grained access tokens, and properly configured regex patterns.

CodeBuild Vulnerability in AWS Exposed Repositories to Supply Chain Risks