Executive brief
A configuration error was discovered in several AWS-managed open-source projects, including the JavaScript SDK and cryptographic libraries. The issue involved weak security filters that could have allowed unauthorized individuals to gain administrative access to the code repositories. While researchers demonstrated they could have added unauthorized code to these projects, AWS confirmed that no malicious changes were made and no customer environments were impacted.
Technical details
The vulnerability stems from insufficient regular expression anchoring in AWS CodeBuild webhook filters for specific GitHub repositories. These filters were intended to restrict build triggers to trusted ACTOR_ID values, but the unanchored regex allowed attackers to bypass the restriction by using a predictably acquired actor ID that matched the weak pattern. If exploited, an attacker could gain administrative permissions for the affected repositories, enabling them to commit unauthorized code or access build-time secrets. AWS mitigated the issue by correcting the regex patterns, rotating credentials, and auditing CloudTrail logs to confirm no malicious exploitation occurred.
Affected products
- AWS aws-sdk-js-v3
- AWS aws-lc
- AWS amazon-corretto-crypto-provider
- AWS (awslabs) open-data-registry
Timeline
- 2026-01-15: advisory: Bulletin 2026-002-AWS published
- 2026-01-15: patched: AWS confirmed remediation of all reported concerns