Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials

A significant GitHub Actions injection vulnerability in Snowflake’s public snowflake-connector-net repository. This flaw could have allowed unauthenticated attackers to execute commands on a GitHub-hosted runner and potentially steal internal Jira credentials.

The vulnerability was discovered by Wiz Red Agent, an autonomous AI-powered security research tool, just five days after the vulnerable workflow was deployed.

Snowflake GitHub Actions Flaw

The issue was located in the repository’s `jira_issue.yml` workflow, which was triggered whenever a GitHub user opened a new issue. The workflow processed the attacker-controlled issue title by directly using GitHub Actions expression interpolation within a shell run block.

This unsafe approach allowed a specially crafted title containing a single quote to escape the expected shell string and inject arbitrary commands. Previously, the workflow had employed a safer method based on environment variables and `jq –arg` parsing. However, that protection was removed in a merged pull request.

According to Wiz, the vulnerable pattern was introduced in commit 094038e. It became active on June 18, 2026, after PR #1218 was squash-merged as commit 4a1b8ce.

This pull request changed the Jira workflow logic. It replaced the protected input-handling mechanism with direct interpolation of `${{ github.event.issue.title }}`.

Despite being scanned by GitHub Advanced Security, the final pull request revision containing the vulnerable workflow was not flagged for script-injection risks.

Additionally, an apparent security gate within the workflow failed to restrict execution properly. The gate attempted to validate an attribute associated with pull-request events, although issue events triggered the workflow.

Since `github.event.pull_request` is null in this context, the condition allowed every GitHub user to trigger the workflow, making the vulnerable automation publicly accessible through the standard issue-creation feature.

Wiz Red Agent identified the vulnerable workflow during a scan of Snowflake’s GitHub organization. The tool autonomously validated the exploitability and assessed the potential impact.

During testing, the system initially encountered a Bash syntax error, analyzed the failed execution, adjusted the injection format, and successfully demonstrated that the runner could access Jira environment variables.

The recovered Jira token authenticated as qa@snowflake.net, confirming read access to sensitive internal projects.

Snowflake received Wiz’s responsible disclosure on June 23, 2026, and remediated the flaw on the same day. The company restored the safer `env:` and `jq –arg` parsing pattern, revoked and rotated the affected Jira credential, and reviewed audit logs.

Both Snowflake and Wiz concluded that Wiz was the only party to access the exposed data during the five-day window, and Wiz confirmed that all proof-of-concept data was securely deleted.

This incident illustrates how CI/CD workflows can be high-impact attack surfaces when untrusted event data is directly inserted into shell commands.

It also highlights that AI-assisted development and automated security scanning do not replace the need for secure coding reviews, explicit input-boundary controls, and the use of least-privilege, short-lived credentials.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC