GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials

GitHub Actions Workflow Injection in Snowflake .NET (TL-2026-2051) is a high-severity software vulnerability, first published 2026-08-17. It has no confirmed attribution, affects Snowflake Inc. snowflakedb/snowflake-connector-net (GitHub Actions, maps to 9 MITRE ATT&CK techniques (T1059.004, T1078.004, T1190), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-2051

Threat ID
TL-2026-2051
Severity
HIGH
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-17
Last reviewed
2026-08-17
Attribution confidence
HIGH
Motivation
UNKNOWN
Target sectors
technology, software-development, cloud-services
Target regions
Global
Detection rules
9
Indicators of compromise
12

Malware and tooling in GitHub Actions Workflow Injection in Snowflake .NET

Malware and tooling: GitHub Copilot Autofix, Interactsh (oast.me), Wiz Red Agent

Wiz's autonomous Red Agent found a GitHub Actions script-injection flaw in snowflakedb/snowflake-connector-net's jira_issue.yml workflow: unsanitized issue title/body text was interpolated into a shell run: block, and an access-control check that referenced a nonexistent pull-request property silently evaluated to an empty string, bypassing the intended gate. A crafted GitHub issue let the AI agent execute arbitrary commands on the Actions runner and exfiltrate a live Jira API token, user email, and base URL covering Snowflake's engineering, security-compliance, and bug-bounty Jira projects.

How GitHub Actions Workflow Injection in Snowflake .NET works

On June 18, 2026, pull request #1218 was merged into the default branch of Snowflake's public snowflakedb/snowflake-connector-net repository, modifying the CI workflow `.github/workflows/jira_issue.yml`. The change removed the repo's existing safe input-handling pattern -- passing the GitHub issue title through an `env:` variable and building JSON with `jq --arg` -- and replaced it with direct expansion of `${{ github.event.issue.title }}` inside a shell `run:` block (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`). Because GitHub Actions expression expansion happens before the shell ever runs, an attacker-controlled issue title is spliced verbatim into the script, making it a textbook GitHub Actions script/template injection. Compounding this, the workflow's access-control gate checked `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'`. On an `issues` event `github.event.pull_request` does not exist, so GitHub evaluates the reference as an empty string; `'' != 'whitesource-for-github-com[bot]'` is always true, so the intended restriction never actually restricted anything.

On June 23, 2026, Wiz Research's autonomous "Red Agent" -- an AI-powered offensive security tool -- discovered the flaw while scanning Snowflake's public repositories for CI/CD weaknesses during authorized testing under Snowflake's HackerOne program. It opened a GitHub issue with a title crafted to break out of the vulnerable `echo '...'` shell string using a leading single quote, then chained a command that read the workflow's exposed `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` environment variables, base64-encoded them, and exfiltrated them as query-string parameters in an HTTP callback to an out-of-band application security testing (OAST/Interactsh) domain (`oast.me`). The agent's first payload attempt (using `#` to comment out trailing shell syntax) failed; it autonomously revised the payload to close the string with `; echo '` and re-triggered the workflow, succeeding within the same session. The callback was received from Azure IP `20.106.182.197`, the GitHub-hosted Actions runner's egress address, and the exfiltrated token authenticated successfully to `snowflakecomputing.atlassian.net`, Snowflake's Jira Cloud instance, granting read access to Jira projects tracking engineering work, security-compliance items, and bug-bounty submissions -- an internal-visibility risk beyond the initial CI runner compromise.

Wiz reported the issue via HackerOne report #3819931 on June 23, 2026. Snowflake merged a fix the same day in PR #1402, restoring the safe `env:` + `jq --arg` pattern so untrusted issue text is passed as a shell argument rather than expanded into the script body, and rotated the exposed Jira token on June 24, 2026. Snowflake stated its investigation, based on Jira audit logs, found Wiz was the only party to access the endpoint during the five-day exposure window (June 18-23) and that no customer data or released software was affected. No CVE, CVSS score, or CISA KEV entry has been assigned to this issue as of publication.

The disclosure carries a secondary storyline: PR #1218, which introduced the vulnerable pattern, credits "Copilot Autofix powered by AI" as a co-author in the commit metadata, and Wiz's writeup frames the bug as an AI code-assist tool inadvertently introducing a critical vulnerability that GitHub's own AI-assisted review then failed to catch. GitHub subsequently stated, after an internal review, that the contributions leading to the vulnerability were authored by a human and were neither reviewed nor contributed to by Copilot. Independent of which account is correct, Wiz has publicly positioned the incident as evidence that frontier AI agents can now autonomously discover and exploit real-world supply-chain/CI-CD weaknesses end-to-end without human operator intervention, and used it to promote general availability of Red Agent (reached ~40% of Wiz's customer base by July 2026).

MITRE ATT&CK techniques used in TL-2026-2051

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in GitHub Actions Workflow Injection in Snowflake .NET

  • Snowflake Inc. — snowflakedb/snowflake-connector-net (GitHub Actions CI/CD workflow: .github/workflows/jira_issue.yml)
    Vulnerable versions: jira_issue.yml as merged via PR #1218 on 2026-06-18 (commit 4a1b8ce) through 2026-06-23
    Fixed in: jira_issue.yml as patched via PR #1402 on 2026-06-23

Remediation for GitHub Actions Workflow Injection in Snowflake .NET

Patches

  • PR #1402 (merged 2026-06-23) restores the env-var + `jq --arg` safe pattern in jira_issue.yml

Immediate actions

  • Audit all GitHub Actions workflows for direct `${{ github.event.* }}` expression expansion inside `run:` shell blocks; convert any found to the `env:` variable + `jq --arg`/quoted-argument pattern
  • Rotate any secrets (API tokens, credentials) that were ever exposed as environment variables to a workflow step reachable from untrusted-input events (issues, issue_comment, pull_request_target)
  • Review GitHub Actions conditional (`if:`) gates for references to context properties (e.g. `github.event.pull_request.*`) that do not exist on the triggering event type -- these silently evaluate to empty string and can nullify the intended check

Workarounds

  • Disable or restrict the jira_issue.yml workflow's trigger on `issues: opened` from non-collaborator accounts until reviewed

Longer-term hardening

  • Adopt GitHub's `actionlint`/`zizmor` or equivalent static analysis in CI to flag unsanitized expression interpolation into shell run: blocks
  • Scope workflow-level `secrets:`/`env:` to the minimum steps that need them rather than exposing them to the entire job
  • Require human security review (not solely AI-assisted review) for any change to CI/CD workflow files that handle secrets or untrusted external triggers
  • Treat AI code-generation/autofix suggestions touching CI/CD security logic as requiring the same scrutiny as security-critical application code

Weaknesses (CWE) in GitHub Actions Workflow Injection in Snowflake .NET

CWE-78, CWE-917, CWE-284

Timeline of GitHub Actions Workflow Injection in Snowflake .NET

  • PR #1218 merged to snowflakedb/snowflake-connector-net's default branch, replacing the safe env:+jq --arg pattern in jira_issue.yml with direct shell expansion of the GitHub issue title/body; commit metadata credits 'Copilot Autofix powered by AI' as co-author.
  • Snowflake merges PR #1402 the same day, restoring the env-var + jq --arg safe pattern in jira_issue.yml.
  • Wiz submits HackerOne report #3819931 to Snowflake disclosing the workflow injection and access-control bypass.
  • Wiz Research's autonomous Red Agent discovers the flaw during authorized testing, crafts a malicious GitHub issue title to break out of the vulnerable shell string, and exfiltrates JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL via an OAST callback to oast.me, received from Azure IP 20.106.182.197.
  • Snowflake rotates the exposed Jira API token belonging to qa@snowflake.net.
  • Wiz's standard 30-day coordinated-disclosure window from the June 23 report elapses, clearing the way for public writeup.
  • GitHub states, following internal review, that the code leading to the vulnerability was human-authored and was not reviewed by or contributed to by Copilot, disputing Wiz's framing.
  • Wiz publishes 'Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot,' with The Hacker News, Forbes, and Cyber Kendra covering the incident and the Copilot-authorship dispute the same day.

Sources cited for GitHub Actions Workflow Injection in Snowflake .NET

More in vulnerability

Detection coverage for TL-2026-2051

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2051 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats