Wiz Research discovered CodeBreach, a critical vulnerability that compromised AWS CodeBuild pipelines, threatening the AWS Console supply chain. Attackers could have taken over key GitHub repositories like the AWS JavaScript SDK, injecting malicious code to affect countless applications and potentially every AWS account.

The flaw stemmed from unanchored regex patterns in webhook filters, allowing attackers with user IDs containing trusted IDs to bypass security. This oversight in CI/CD configuration created a window for privilege escalation and credential theft, mirroring recent supply chain attacks like the Amazon Q extension incident.

AWS swiftly patched the issue and introduced global hardening, including a Pull Request Comment Approval gate. Organizations using CodeBuild must audit their configurations, secure GitHub connections with minimal-permission PATs, and avoid untrusted pull request triggers to prevent similar exploits.