# GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials

> Wiz's autonomous Red Agent found a GitHub Actions script-injection flaw in snowflakedb/snowflake-connector-net's jira_issue.yml workflow: unsanitized issue title/body text was interpolated into a shell run: block, and an access-control check that referenced a nonexistent pull-request property silently evaluated to an empty string, bypassing the intended gate. A crafted GitHub issue let the AI agent execute arbitrary commands on the Actions runner and exfiltrate a live Jira API token, user email, and base URL covering Snowflake's engineering, security-compliance, and bug-bounty Jira projects.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2051
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-snowflake-github-actions-injection-tl-2026-2051.webp?v=6f8df9c1 (Threadlinqs threat intel: Snowflake .NET Connector GitHub Actions Injection Flaw (TL-2026-2051) — High severity, 12 IOCs, 9 detection rules.)
- **ID:** TL-2026-2051
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)

## Description

On June 18, 2026, pull request #1218 was merged into the default branch of Snowflake's public snowflakedb/snowflake-connector-net repository, modifying the CI workflow `.github/workflows/jira_issue.yml`. The change removed the repo's existing safe input-handling pattern -- passing the GitHub issue title through an `env:` variable and building JSON with `jq --arg` -- and replaced it with direct expansion of `${{ github.event.issue.title }}` inside a shell `run:` block (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`). Because GitHub Actions expression expansion happens before the shell ever runs, an attacker-controlled issue title is spliced verbatim into the script, making it a textbook GitHub Actions script/template injection. Compounding this, the workflow's access-control gate checked `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'`. On an `issues` event `github.event.pull_request` does not exist, so GitHub evaluates the reference as an empty string; `'' != 'whitesource-for-github-com[bot]'` is always true, so the intended restriction never actually restricted anything.

On June 23, 2026, Wiz Research's autonomous "Red Agent" -- an AI-powered offensive security tool -- discovered the flaw while scanning Snowflake's public repositories for CI/CD weaknesses during authorized testing under Snowflake's HackerOne program. It opened a GitHub issue with a title crafted to break out of the vulnerable `echo '...'` shell string using a leading single quote, then chained a command that read the workflow's exposed `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` environment variables, base64-encoded them, and exfiltrated them as query-string parameters in an HTTP callback to an out-of-band application security testing (OAST/Interactsh) domain (`oast.me`). The agent's first payload attempt (using `#` to comment out trailing shell syntax) failed; it autonomously revised the payload to close the string with `; echo '` and re-triggered the workflow, succeeding within the same session. The callback was received from Azure IP `20.106.182.197`, the GitHub-hosted Actions runner's egress address, and the exfiltrated token authenticated successfully to `snowflakecomputing.atlassian.net`, Snowflake's Jira Cloud instance, granting read access to Jira projects tracking engineering work, security-compliance items, and bug-bounty submissions -- an internal-visibility risk beyond the initial CI runner compromise.

Wiz reported the issue via HackerOne report #3819931 on June 23, 2026. Snowflake merged a fix the same day in PR #1402, restoring the safe `env:` + `jq --arg` pattern so untrusted issue text is passed as a shell argument rather than expanded into the script body, and rotated the exposed Jira token on June 24, 2026. Snowflake stated its investigation, based on Jira audit logs, found Wiz was the only party to access the endpoint during the five-day exposure window (June 18-23) and that no customer data or released software was affected. No CVE, CVSS score, or CISA KEV entry has been assigned to this issue as of publication.

The disclosure carries a secondary storyline: PR #1218, which introduced the vulnerable pattern, credits "Copilot Autofix powered by AI" as a co-author in the commit metadata, and Wiz's writeup frames the bug as an AI code-assist tool inadvertently introducing a critical vulnerability that GitHub's own AI-assisted review then failed to catch. GitHub subsequently stated, after an internal review, that the contributions leading to the vulnerability were authored by a human and were neither reviewed nor contributed to by Copilot. Independent of which account is correct, Wiz has publicly positioned the incident as evidence that frontier AI agents can now autonomously discover and exploit real-world supply-chain/CI-CD weaknesses end-to-end without human operator intervention, and used it to promote general availability of Red Agent (reached ~40% of Wiz's customer base by July 2026).

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1583.001 Acquire Infrastructure: Domains
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1078.004 Valid Accounts: Cloud Accounts
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SPL: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection** (`TL-2026-2051-SPL-001`)

Detects a GitHub issue title or body containing shell metacharacters (quote-breakout, command chaining/substitution) or a raw ${{ github.event.* }} token, consistent with a GitHub Actions script/template injection payload crafted to break out of an unsanitized `run:` shell block built via direct expression expansion instead of the safe env:+jq --arg pattern (as exploited via snowflakedb/snowflake-connector-net's jira_issue.yml, PR #1218).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004, T1595.002
- **Data sources:** github_audit_log, github_actions_workflow_run_log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=github sourcetype="github:audit:issues" (action="issues.opened" OR action="issues.edited")
| eval title=coalesce(issue_title, title), body=coalesce(issue_body, body)
| eval susp_title=if(match(title, "(?i)('\s*(;|\||&&|\$\())|(\$\{\{)"), 1, 0)
| eval susp_body=if(match(body, "(?i)('\s*(;|\||&&|\$\())|((curl|wget)\S*.{0,60}(oast\.|interact\.sh|burpcollaborator|oastify\.com))"), 1, 0)
| where susp_title=1 OR susp_body=1
| stats earliest(_time) as first_seen, latest(_time) as last_seen, values(action) as actions, values(title) as titles, values(body) as bodies, count by repo, actor, issue_number
| table first_seen, last_seen, repo, actor, issue_number, titles, bodies, actions, count
```

### Microsoft KQL

```kql
GitHubIssueEvent_CL
| where TimeGenerated > ago(24h)
| where Action_s in ("opened", "edited")
| extend TitleText = tostring(Title_s), BodyText = tostring(Body_s)
| where TitleText matches regex @"(?i)('\s*(;|\||&&|\$\())|(\$\{\{)"
    or BodyText matches regex @"(?i)('\s*(;|\||&&|\$\())|((curl|wget).{0,60}(oast\.|interact\.sh|burpcollaborator|oastify\.com))"
| project TimeGenerated, Repo_s, Actor_s, IssueNumber_d, TitleText, BodyText, Action_s
```

### Sigma

```yaml
title: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection
id: 7e3a1c2e-4b5f-4a1a-9c3e-1a2b3c4d5e01
status: experimental
description: Detects a GitHub issue title or body containing shell metacharacters consistent with breaking out of an unsanitized ${{ github.event.issue.* }} expansion inside a GitHub Actions run: shell block (script/template injection), as exploited against snowflakedb/snowflake-connector-net's jira_issue.yml.
references:
    - https://github.com/snowflakedb/snowflake-connector-net/pull/1402
    - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-17
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.reconnaissance
    - attack.t1595.002
logsource:
    category: application
    product: github
    service: issues
detection:
    selection_title:
        Title|re: "(?i)('\s*(;|\||&&|\$\()|\$\{\{)"
    selection_body:
        Body|re: "(?i)('\s*(;|\||&&|\$\()|((curl|wget).{0,60}(oast\.|interact\.sh|burpcollaborator|oastify\.com)))"
    condition: 1 of selection_*
falsepositives:
    - Legitimate issue reports discussing shell syntax, CI/CD debugging, or pasted code blocks that contain similar characters
    - Authorized bug-bounty PoC submissions during a sanctioned test window
level: high
```

**Known false positives:**

- Legitimate bug reports or CI/CD discussion issues that include shell syntax examples or code blocks resembling injection payloads
- Security researchers submitting proof-of-concept issues as part of an authorized bug-bounty test (e.g. Wiz Red Agent, HackerOne researchers)

**Tuning notes:** Maintain an allowlist of known bug-bounty/security-research GitHub accounts (e.g. Wiz, HackerOne triage bots) to suppress expected PoC-issue noise during authorized testing windows; scope the body regex to workflow-trigger-relevant repos to reduce noise from unrelated issue discussion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- KQL: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection (locked: unlock with TL Creds)
- KQL: Secret Environment Variable Leakage and Base64 Exfil Staging in Actions Job Logs (locked: unlock with TL Creds)
- KQL: OAST/Interactsh Callback from CI Egress Followed by Downstream SaaS Token Reuse (locked: unlock with TL Creds)
- Sigma: GitHub Issue Shell-Breakout Payload Targeting Actions Workflow Injection (locked: unlock with TL Creds)
- Sigma: Base64-Encoded Secret Exfiltration via curl/wget on CI Runner Host (locked: unlock with TL Creds)
- Sigma: DNS Callback to OAST/Interactsh Domain from CI/CD Runner Egress (locked: unlock with TL Creds)
- SPL: Secret Environment Variable Leakage and Base64 Exfil Staging in Actions Job Logs (locked: unlock with TL Creds)
- SPL: OAST/Interactsh Callback from CI Egress Followed by Downstream SaaS Token Reuse (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- IP address: `20.106.182[.]197`
- Domain: `oast[.]me`
- Domain: `snowflakecomputing[.]atlassian[.]net`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Snowflake GitHub Actions Flaw Lets Attackers Access Jira Credentials via Workflow Injection](https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets_0330881554.html)
- [Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot](https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug)
- [Introducing the Wiz Red Agent - AI-Powered Attacker](https://www.wiz.io/blog/introducing-the-wiz-red-agent)
- [Fix PR #1402 - adjust jira yml files](https://github.com/snowflakedb/snowflake-connector-net/pull/1402)
- [Vulnerable workflow at introducing commit](https://github.com/snowflakedb/snowflake-connector-net/blob/4a1b8cecd65b899540e4324715557d6b080ddeb5/.github/workflows/jira_issue.yml)
- [Copilot Autofix Bug Exposed Snowflake's Internal Jira](https://www.cyberkendra.com/2026/08/copilot-autofix-snowflake-jira-github-actions.html)
- [GitHub Copilot Missed A Vulnerability That Wiz's AI Agent Found](https://www.forbes.com/sites/timkeary/2026/08/17/github-copilot-missed-a-vulnerability-that-wizs-ai-agent-found/)
- [GitHub Actions: Contexts reference documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2051