Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow cont…
Intelligence analysis by Llama
A new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a public issue was opened and exposed JIRA_BASE_URL, JIRA_USER_EMAIL…
Imagine you're working on a project and you need to fix some issues. But what if someone could trick the system into doing something bad? That's what happened with Snowflake's GitHub Actions workflow. Someone found a way to make the system do something it shouldn't, and that's not good. It's like someone trying to hack into a secure system, but this time it was a mistake in the code that made it possible.
Analysis
Vulnerability Details
The vulnerability was discovered by cybersecurity researchers at Wiz in Snowflake's public snowflakedb/snowflake-connector-net repository. The issue was present in .github/workflows/jira_issue.yml, which ran when a public issue was opened and exposed JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN to the same workflow step. The weakness was confined to the repository's CI/CD automation, with no affected Snowflake Connector for .NET release identified.
Exploitation
Wiz said its Red Agent system exploited the injection during authorized security testing after the first payload resulted in a shell syntax error and the system changed its approach. The researchers said they subsequently received an out-of-band callback from the GitHub Actions runner and obtained the Jira API token used by the workflow. The token, according to Wiz, belonged to qa@snowflake.net and allowed read access to Jira projects covering engineering, security compliance, and bug bounty tracking on snowflakecomputing.atlassian.net.
Fix
Snowflake merged a fix that day in pull request #1402, replacing the direct GitHub expression expansion with environment variables that are passed to jq as arguments. The vulnerable workflow had reached the default branch five days earlier, on June 18, when pull request #1218 was merged. The corrected handling remains in the repository's master branch.
Background
The underlying Jira permissions, workflow run, and audit records are not public. Wiz said it reported the issue to Snowflake through HackerOne on June 23, 2026, under report #3819931. Snowflake said in a statement reproduced by Wiz that 'our investigation found no evidence of unauthorized access.' Wiz said the Jira token was rotated on June 24 and that Snowflake's review found no unrelated external use of it during the five-day exposure window.
Attribution
Wiz described the flaw as resulting from a GitHub Copilot Autofix change, although the underlying GitHub history does not establish Copilot as the author of the vulnerable jira_issue.yml code. The explicit Copilot co-authored commit, 6d0e2fa, changed jira_close.yml, while the unsafe jira_issue.yml refactor appears in a separate August 25, 2025, commit, 094038e, attributed by GitHub to sfc-gh-hpathak. Both changes were later folded into the June 18 squash merge commit 4a1b8ce, which lists Copilot Autofix among its co-authors.
Key points
- A new GitHub Actions workflow injection vulnerability was discovered in Snowflake's public snowflakedb/snowflake-connector-net repository.
- The issue could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials.
- Snowflake has already fixed the issue and rotated the Jira token.
- The corrected handling remains in the repository's master branch.
Snowflake has already fixed the issue and rotated the Jira token, so the risk of unauthorized access has been mitigated. Additionally, the corrected handling remains in the repository's master branch, ensuring that the vulnerability is not present in the latest version of the code.
The fact that the vulnerability was present in the repository for five days before it was discovered and fixed is concerning. It highlights the importance of regular security testing and code reviews to prevent such issues from going undetected.
