GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials — Threadlinqs Intelligence
As of 2026-08-17, GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials is a high-severity vulnerability threat attributed to None identified -- authorized security research by Wiz Red Agent, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-2051 · Severity: HIGH · Status: PATCHED · Category: VULNERABILITY
Attribution: None identified -- authorized security research by Wiz Red Agent · UNKNOWN
Wiz's autonomous Red Agent found a GitHub Actions script-injection flaw in snowflakedb/snowflake-connector-net's jira_issue.yml workflow: unsanitized issue title/body text was interpolated into a
On June 18, 2026, pull request #1218 was merged into the default branch of Snowflake's public snowflakedb/snowflake-connector-net repository, modifying the CI workflow `.github/workflows/jira_issue.yml`. The change removed the repo's existing safe input-handling pattern -- passing the GitHub issue title through an `env:` variable and building JSON with `jq --arg` -- and replaced it with direct expansion of `${{ github.event.issue.title }}` inside a shell `run:` block (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`). Because GitHub Actions expression expansion happens before the shell ever runs, an attacker-controlled issue title is spliced verbatim into the script, making it a textbook GitHub Actions script/template injection. Compounding this, the workflow's access-control gate checked `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'`. On an `issues` event `github.event.pull_request` does not exist, so GitHub evaluates the reference as an empty string; `'' != 'whitesource-for-github-com[bot]'` is always true, so the intended restriction never actually restricted anything.
On June 23, 2026, Wiz Research's autonomous "Red Agent" -- an AI-powered offensive security tool -- discovered the flaw while scanning Snowflake's public repositories for CI/CD weaknesses during authorized testing under Snowflake's HackerOne program. It opened a GitHub issue with a title crafted to break out of the vulnerable `echo '...'` shell string using a leading single quote, then chained a command that read the workflow's exposed `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` environment variables, base64-encoded them, and exfiltrated them as query-string parameters in an HTTP callback to an out-of-band application security testing (OAST/Interactsh) domain (`oast.me`). The agent's first payload attempt (using `#` to comment out trailing shell syntax) failed; it autonomously revised the payload to close the string with `; echo '` and re-triggered the workflow, succeeding within the same session. The callback was received from Azure IP `20.106.182.197`, the GitHub-hosted Actions runner's egress address, and the exfiltrated token authenticated successfully to `snowflakecomputing.atlassian.net`, Snowflake's Jira Cloud instance, granting read access to Jira projects tracking engineering work, security-compliance items, and bug-bounty submissions -- an internal-visibility risk beyond the initial CI runner compromise.
Wiz reported the issue via HackerOne report #3819931 on June 23, 2026. Snowflake merged a fix the same day in PR #1402, restoring the safe `env:` + `jq --arg` pattern so untrusted issue text is passed as a shell argument rather than expanded into the script body, and rotated the exposed Jira token on June 24, 2026. Snowflake stated its investigation, based on Jira audit logs, found Wiz was the only party to access the endpoint during the five-day exposure window (June 18-23) and that no customer data or released software was affected. No CVE, CVSS score, or CISA KEV entry has been assigned to this issue as of publication.
The disclosure carries a secondary storyline: PR #1218, which introduced the vulnerable pattern, credits "Copilot Autofix powered by AI" as a co-author in the commit metadata, and Wiz's writeup frames the bug as an AI code-assist tool inadvertently introducing a critical vulnerability that GitHub's own AI-assisted review then failed to catch. GitHub subsequently stated, after an internal review, that the contributions leading to the vulnerability were authored by a human and were neither reviewed nor contributed to by Copilot. Independent of which account is correct, Wiz has publicly positioned the incident as evidence that frontier AI agents can now autonomously discover and exploit real-world supply-chain/CI-CD weaknesses end-to-end without human operator intervention, and used it to promote general availability of Red Agent (reached ~40% of Wiz's customer base by July 2026)
Weaknesses (CWE)
CWE-78, CWE-917, CWE-284
Target sectors: technology, software-development, cloud-services
Target regions: Global
Timeline
- PR #1218 merged to snowflakedb/snowflake-connector-net's default branch, replacing the safe env:+jq --arg pattern in jira_issue.yml with direct shell expansion of the GitHub issue title/body; commit metadata credits 'Copilot Autofix powered by AI' as co-author.
- Wiz Research's autonomous Red Agent discovers the flaw during authorized testing, crafts a malicious GitHub issue title to break out of the vulnerable shell string, and exfiltrates JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL via an OAST callback to oast.me, received from Azure IP 20.106.182.197.
- Wiz submits HackerOne report #3819931 to Snowflake disclosing the workflow injection and access-control bypass.
- Snowflake merges PR #1402 the same day, restoring the env-var + jq --arg safe pattern in jira_issue.yml.
- Snowflake rotates the exposed Jira API token belonging to qa@snowflake.net.
- Wiz's standard 30-day coordinated-disclosure window from the June 23 report elapses, clearing the way for public writeup.
- Wiz publishes 'Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot,' with The Hacker News, Forbes, and Cyber Kendra covering the incident and the Copilot-authorship dispute the same day.
- GitHub states, following internal review, that the code leading to the vulnerability was human-authored and was not reviewed by or contributed to by Copilot, disputing Wiz's framing.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1595.002, T1583.001, T1588.002, T1190, T1059.004, T1552, T1528, T1078.004, T1213
