AWS CodeBuild Misconfiguration Exposed GitHub Repos to Potential Supply Chain Attacks

A critical misconfiguration in AWS CodeBuild could have allowed attackers to take over GitHub repositories used by AWS, including the AWS JavaScript SDK, exposing the potential for supply chain attacks, according to Wiz. The vulnerability, codenamed CodeBreach, was fixed by AWS in September 2025 following responsible disclosure on 25 August 2025, with researchers Yuval Avrahami and Nir Ohfeld describing the risk in a report shared with The Hacker News.

The flaw stemmed from a weakness in CI pipelines that could let unauthenticated attackers breach the build environment, leak privileged credentials such as GitHub admin tokens, and push malicious changes to compromised repos, enabling broader access to the AWS environment.

Four AWS-managed open source GitHub repositories configured to run builds on pull requests were affected: aws-sdk-js-v3, aws-lc, amazon-corretto-crypto-provider, and awslabs/open-data-registry, each suffering from missing start and end anchors in their actor ID regex filters.

Amazon said the issue was a project-specific misconfiguration and not a flaw in CodeBuild itself, and it implemented mitigations including credential rotations and securing in-memory credentials, while confirming there was no evidence CodeBreach was exploited in the wild.