GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials

Key facts for Snowflake GitHub Actions injection

Detection coverage for Snowflake GitHub Actions injection

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2051 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SPL: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection

Detects a GitHub issue title or body containing shell metacharacters (quote-breakout, command chaining/substitution) or a raw ${{ github.event.* }} token, consistent with a GitHub Actions script/template injection payload crafted to break out of an unsanitized `run:` shell block built via direct expression expansion instead of the safe env:+jq --arg pattern (as exploited via snowflakedb/snowflake-connector-net's jira_issue.yml, PR #1218).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.004, T1595.002
• Data sources: github_audit_log, github_actions_workflow_run_log
• Severity: high
• Confidence: high

Splunk SPL

index=github sourcetype="github:audit:issues" (action="issues.opened" OR action="issues.edited")
| eval title=coalesce(issue_title, title), body=coalesce(issue_body, body)
| eval susp_title=if(match(title, "(?i)('\s*(;|\||&&|\$\())|(\$\{\{)"), 1, 0)
| eval susp_body=if(match(body, "(?i)('\s*(;|\||&&|\$\())|((curl|wget)\S*.{0,60}(oast\.|interact\.sh|burpcollaborator|oastify\.com))"), 1, 0)
| where susp_title=1 OR susp_body=1
| stats earliest(_time) as first_seen, latest(_time) as last_seen, values(action) as actions, values(title) as titles, values(body) as bodies, count by repo, actor, issue_number
| table first_seen, last_seen, repo, actor, issue_number, titles, bodies, actions, count

Microsoft KQL

GitHubIssueEvent_CL
| where TimeGenerated > ago(24h)
| where Action_s in ("opened", "edited")
| extend TitleText = tostring(Title_s), BodyText = tostring(Body_s)
| where TitleText matches regex @"(?i)('\s*(;|\||&&|\$\())|(\$\{\{)"
    or BodyText matches regex @"(?i)('\s*(;|\||&&|\$\())|((curl|wget).{0,60}(oast\.|interact\.sh|burpcollaborator|oastify\.com))"
| project TimeGenerated, Repo_s, Actor_s, IssueNumber_d, TitleText, BodyText, Action_s

Sigma

title: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection
id: 7e3a1c2e-4b5f-4a1a-9c3e-1a2b3c4d5e01
status: experimental
description: Detects a GitHub issue title or body containing shell metacharacters consistent with breaking out of an unsanitized ${{ github.event.issue.* }} expansion inside a GitHub Actions run: shell block (script/template injection), as exploited against snowflakedb/snowflake-connector-net's jira_issue.yml.
references:
    - https://github.com/snowflakedb/snowflake-connector-net/pull/1402
    - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-17
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.reconnaissance
    - attack.t1595.002
logsource:
    category: application
    product: github
    service: issues
detection:
    selection_title:
        Title|re: "(?i)('\s*(;|\||&&|\$\()|\$\{\{)"
    selection_body:
        Body|re: "(?i)('\s*(;|\||&&|\$\()|((curl|wget).{0,60}(oast\.|interact\.sh|burpcollaborator|oastify\.com)))"
    condition: 1 of selection_*
falsepositives:
    - Legitimate issue reports discussing shell syntax, CI/CD debugging, or pasted code blocks that contain similar characters
    - Authorized bug-bounty PoC submissions during a sanctioned test window
level: high

Known false positives:

• Legitimate bug reports or CI/CD discussion issues that include shell syntax examples or code blocks resembling injection payloads
• Security researchers submitting proof-of-concept issues as part of an authorized bug-bounty test (e.g. Wiz Red Agent, HackerOne researchers)

Tuning notes: Maintain an allowlist of known bug-bounty/security-research GitHub accounts (e.g. Wiz, HackerOne triage bots) to suppress expected PoC-issue noise during authorized testing windows; scope the body regex to workflow-trigger-relevant repos to reduce noise from unrelated issue discussion.

• 🔒 KQL: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection · unlock with TL Creds
• 🔒 KQL: Secret Environment Variable Leakage and Base64 Exfil Staging in Actions Job Logs · unlock with TL Creds
• 🔒 KQL: OAST/Interactsh Callback from CI Egress Followed by Downstream SaaS Token Reuse · unlock with TL Creds
• 🔒 Sigma: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection · unlock with TL Creds
• 🔒 Sigma: Base64-Encoded Secret Exfiltration via curl/wget on CI Runner Host · unlock with TL Creds
• 🔒 Sigma: DNS Callback to OAST/Interactsh Domain from CI/CD Runner Egress · unlock with TL Creds
• 🔒 SPL: Secret Environment Variable Leakage and Base64 Exfil Staging in Actions Job Logs · unlock with TL Creds
• 🔒 SPL: OAST/Interactsh Callback from CI Egress Followed by Downstream SaaS Token Reuse · unlock with TL Creds

Indicators of compromise for Snowflake GitHub Actions injection

As of 2026-08-17, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2051.

Sample indicators (3 of 12)

• IP address: 20.106.182[.]197
• Domain: oast[.]me
• Domain: snowflakecomputing[.]atlassian[.]net

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

How Snowflake GitHub Actions injection works

A crafted GitHub issue let the AI agent execute arbitrary commands on the Actions runner and exfiltrate a live Jira API token, user email, and base URL covering Snowflake's engineering, security-compliance, and bug-bounty Jira projects.

On June 18, 2026, pull request #1218 was merged into the default branch of Snowflake's public snowflakedb/snowflake-connector-net repository, modifying the CI workflow `.github/workflows/jira_issue.yml`. The change removed the repo's existing safe input-handling pattern -- passing the GitHub issue title through an `env:` variable and building JSON with `jq --arg` -- and replaced it with direct expansion of `${{ github.event.issue.title }}` inside a shell `run:` block (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`). Because GitHub Actions expression expansion happens before the shell ever runs, an attacker-controlled issue title is spliced verbatim into the script, making it a textbook GitHub Actions script/template injection. Compounding this, the workflow's access-control gate checked `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'`. On an `issues` event `github.event.pull_request` does not exist, so GitHub evaluates the reference as an empty string; `'' != 'whitesource-for-github-com[bot]'` is always true, so the intended restriction never actually restricted anything.

On June 23, 2026, Wiz Research's autonomous "Red Agent" -- an AI-powered offensive security tool -- discovered the flaw while scanning Snowflake's public repositories for CI/CD weaknesses during authorized testing under Snowflake's HackerOne program. It opened a GitHub issue with a title crafted to break out of the vulnerable `echo '...'` shell string using a leading single quote, then chained a command that read the workflow's exposed `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` environment variables, base64-encoded them, and exfiltrated them as query-string parameters in an HTTP callback to an out-of-band application security testing (OAST/Interactsh) domain (`oast.me`). The agent's first payload attempt (using `#` to comment out trailing shell syntax) failed; it autonomously revised the payload to close the string with `; echo '` and re-triggered the workflow, succeeding within the same session. The callback was received from Azure IP `20.106.182.197`, the GitHub-hosted Actions runner's egress address, and the exfiltrated token authenticated successfully to `snowflakecomputing.atlassian.net`, Snowflake's Jira Cloud instance, granting read access to Jira projects tracking engineering work, security-compliance items, and bug-bounty submissions -- an internal-visibility risk beyond the initial CI runner compromise.

Wiz reported the issue via HackerOne report #3819931 on June 23, 2026. Snowflake merged a fix the same day in PR #1402, restoring the safe `env:` + `jq --arg` pattern so untrusted issue text is passed as a shell argument rather than expanded into the script body, and rotated the exposed Jira token on June 24, 2026. Snowflake stated its investigation, based on Jira audit logs, found Wiz was the only party to access the endpoint during the five-day exposure window (June 18-23) and that no customer data or released software was affected. No CVE, CVSS score, or CISA KEV entry has been assigned to this issue as of publication.

The disclosure carries a secondary storyline: PR #1218, which introduced the vulnerable pattern, credits "Copilot Autofix powered by AI" as a co-author in the commit metadata, and Wiz's writeup frames the bug as an AI code-assist tool inadvertently introducing a critical vulnerability that GitHub's own AI-assisted review then failed to catch. GitHub subsequently stated, after an internal review, that the contributions leading to the vulnerability were authored by a human and were neither reviewed nor contributed to by Copilot. Independent of which account is correct, Wiz has publicly positioned the incident as evidence that frontier AI agents can now autonomously discover and exploit real-world supply-chain/CI-CD weaknesses end-to-end without human operator intervention, and used it to promote general availability of Red Agent (reached ~40% of Wiz's customer base by July 2026).

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for Snowflake GitHub Actions injection

Patches

• PR #1402 (merged 2026-06-23) restores the env-var + `jq --arg` safe pattern in jira_issue.yml

Immediate actions

• Audit all GitHub Actions workflows for direct `${{ github.event.* }}` expression expansion inside `run:` shell blocks; convert any found to the `env:` variable + `jq --arg`/quoted-argument pattern
• Rotate any secrets (API tokens, credentials) that were ever exposed as environment variables to a workflow step reachable from untrusted-input events (issues, issue_comment, pull_request_target)
• Review GitHub Actions conditional (`if:`) gates for references to context properties (e.g. `github.event.pull_request.*`) that do not exist on the triggering event type -- these silently evaluate to empty string and can nullify the intended check

Workarounds

• Disable or restrict the jira_issue.yml workflow's trigger on `issues: opened` from non-collaborator accounts until reviewed

Longer-term hardening

• Adopt GitHub's `actionlint`/`zizmor` or equivalent static analysis in CI to flag unsanitized expression interpolation into shell run: blocks
• Scope workflow-level `secrets:`/`env:` to the minimum steps that need them rather than exposing them to the entire job
• Require human security review (not solely AI-assisted review) for any change to CI/CD workflow files that handle secrets or untrusted external triggers
• Treat AI code-generation/autofix suggestions touching CI/CD security logic as requiring the same scrutiny as security-critical application code

Affected and fixed versions

• Snowflake Inc. — snowflakedb/snowflake-connector-net (GitHub Actions CI/CD workflow: .github/workflows/jira_issue.yml)
  Vulnerable versions: jira_issue.yml as merged via PR #1218 on 2026-06-18 (commit 4a1b8ce) through 2026-06-23
  Fixed in: jira_issue.yml as patched via PR #1402 on 2026-06-23

Timeline of Snowflake GitHub Actions injection

• 2026-06-18 PR #1218 merged to locked-ioc-2's default branch, replacing the safe env:+jq --arg pattern in jira_issue.yml with direct shell expansion of the GitHub issue title/body; commit metadata credits 'Copilot Autofix powered by AI' as co-author.
• 2026-06-23 Snowflake merges PR #1402 the same day, restoring the env-var + jq --arg safe pattern in jira_issue.yml.
• 2026-06-23 Wiz submits HackerOne report #3819931 to Snowflake disclosing the workflow injection and access-control bypass.
• 2026-06-23 Wiz Research's autonomous Red Agent discovers the flaw during authorized testing, crafts a malicious GitHub issue title to break out of the vulnerable shell string, and exfiltrates JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL via an OAST callback to locked-ioc-12, received from Azure IP locked-ioc-9.
• 2026-06-24 Snowflake rotates the exposed Jira API token belonging to locked-ioc-7.
• 2026-07-25 Wiz's standard 30-day coordinated-disclosure window from the June 23 report elapses, clearing the way for public writeup.
• 2026-08-17 GitHub states, following internal review, that the code leading to the vulnerability was human-authored and was not reviewed by or contributed to by Copilot, disputing Wiz's framing.
• 2026-08-17 Wiz publishes 'Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot,' with The Hacker News, Forbes, and Cyber Kendra covering the incident and the Copilot-authorship dispute the same day.

Sources cited for Snowflake GitHub Actions injection

• Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot Wiz · Research · 2026-08-17
• Introducing the Wiz Red Agent - AI-Powered Attacker Wiz · Vendor report · 2026-08-17
• GitHub Actions: Contexts reference documentation GitHub · Vendor report · 2026-08-17
• Fix PR #1402 - adjust jira yml files GitHub · Code repository · 2026-06-23
• Vulnerable workflow at introducing commit GitHub · Code repository · 2026-06-18
• Copilot Autofix Bug Exposed Snowflake's Internal Jira cyberkendra.com · Blog · 2026-08-17
• Snowflake GitHub Actions Flaw Lets Attackers Access Jira Credentials via Workflow Injection The Hacker News · News · 2026-08-17
• GitHub Copilot Missed A Vulnerability That Wiz's AI Agent Found forbes.com · News · 2026-08-17

Threats related to Snowflake GitHub Actions injection

• CVE-2026-42271: LiteLLM MCP Server Command Injection Under Active Exploitation, Chained with CVE-2026-48710 (Starlette BadHost) for Unauthenticated RCE

Previous and next in vulnerability

• Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access Previous report
• CVE-2026-15748: Forminator WordPress Plugin Arbitrary File Upload Enables Unauthenticated RCE Next report