Snowflake GitHub Actions Workflow Injection Exposes Internal Jira Credentials

Snowflake GitHub Actions Workflow Injection Exposes Internal (TL-2026-2189) is a high-severity software vulnerability, first published 2026-08-28. It has no confirmed attribution, affects Snowflake Inc. snowflake-connector-net (GitHub Actions CI/CD workflow, maps to 9 MITRE ATT&CK techniques (T1059.004, T1071.001, T1132.001), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-2189

Threat ID
TL-2026-2189
Severity
HIGH
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-28
Last reviewed
2026-08-28
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, cloud-computing
Target regions
Global
Detection rules
9
Indicators of compromise
13

Malware and tooling in Snowflake GitHub Actions Workflow Injection Exposes Internal

Malware and tooling: GitHub Copilot Autofix, Interactsh (oast.me public OOB server), Wiz Red Agent

A script-injection flaw in Snowflake's public snowflake-connector-net repository (.github/workflows/jira_issue.yml) let an unauthenticated actor who opened a crafted GitHub issue break out of a shell string, bypass a broken bot-allowlist check, and exfiltrate the workflow's live JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN secrets via an out-of-band HTTP callback. Wiz Research's autonomous Red Agent independently discovered and exploited the bug during authorized testing, reported it via HackerOne, and Snowflake patched and rotated the token within a day.

How Snowflake GitHub Actions Workflow Injection Exposes Internal works

The snowflakedb/snowflake-connector-net repository's .github/workflows/jira_issue.yml workflow ran on public `issues` events and interpolated the untrusted `github.event.issue.title` value directly into a bash string (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`) before any shell escaping occurred. A guard condition intended to restrict execution — `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'` — was structurally broken: on `issues` events `github.event.pull_request` never exists, so GitHub Actions evaluates the dereference as an empty string, making the condition always true and allowing any unauthenticated GitHub user to trigger the workflow with attacker-controlled input.

The unsafe pattern was reintroduced on 2026-06-18 when PR #1218 (squash commit 4a1b8ce) replaced an earlier safe `env:` + `jq --arg` parsing approach (traceable to commit 094038e from 2025-08-25) with direct `${{ }}` expression interpolation inside a `run:` block. GitHub Copilot Autofix reviewed the final revision of PR #1218 and did not flag the injection.

Wiz Research's autonomous Red Agent system discovered the flaw on 2026-06-23 while probing the public repository, and exploited it without human intervention: an initial payload using a `#` comment character caused a bash syntax error by consuming the closing parenthesis of `TITLE=$(...)`, and the agent adapted by crafting a payload that closed and reopened the quoted string (`'; curl ...; echo '`) to inject a valid shell command. The final payload issued a `curl` call to an attacker-controlled `oast.me` subdomain (an Interactsh-class out-of-band interaction service) with `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` base64-encoded into the URL query string, exfiltrating them from the GitHub-hosted Actions runner (egress IP 20.106.182.197, Azure-hosted).

The exfiltrated token belonged to a Jira service account (qa@snowflake.net) with read access to snowflakecomputing.atlassian.net projects covering engineering, security compliance, and bug-bounty tracking. Wiz reported the finding to Snowflake via HackerOne (report #3819931) the same day it was found; Snowflake merged a fix (PR #1402, commit 1dc7766) restoring the `env:` + `jq --arg` pattern within hours, and rotated the exposed Jira token on 2026-06-24. Snowflake's investigation found no evidence the flaw was exploited by anyone other than Wiz's authorized Red Agent, and no snowflake-connector-net package releases were affected — the vulnerability was confined to the repository's CI/CD workflow configuration.

MITRE ATT&CK techniques used in TL-2026-2189

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1132.001 Data Encoding: Standard Encoding

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Credential Access

T1552 Unsecured Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1594 Search Victim-Owned Websites

Affected products and versions in Snowflake GitHub Actions Workflow Injection Exposes Internal

  • Snowflake Inc. — snowflake-connector-net (GitHub Actions CI/CD workflow: .github/workflows/jira_issue.yml)
    Vulnerable versions: Workflow config from commit 4a1b8ce (PR #1218, merged 2026-06-18) through 2026-06-23
    Fixed in: Workflow config from commit 1dc7766 (PR #1402, merged 2026-06-23) onward

Remediation for Snowflake GitHub Actions Workflow Injection Exposes Internal

Patches

  • PR #1402 / commit 1dc7766 — restores env: + jq --arg parsing in .github/workflows/jira_issue.yml

Immediate actions

  • Rotate any secrets (JIRA_API_TOKEN, JIRA_USER_EMAIL, JIRA_BASE_URL) previously exposed to the jira_issue.yml workflow step — completed by Snowflake on 2026-06-24
  • Audit all GitHub Actions workflows for direct ${{ github.event.* }} expression interpolation inside run: shell blocks, especially on issues/issue_comment/pull_request_target triggers

Workarounds

  • Restrict workflows triggered by public-facing events (issues, issue_comment) from running with access to repository secrets until all interpolated inputs are routed through intermediate environment variables

Longer-term hardening

  • Adopt the environment-variable + native-argument parsing pattern (env: block followed by jq --arg or shell positional parameters) instead of inline expression expansion for any workflow triggered by public/untrusted events
  • Add CI linting (e.g. actionlint, zizmor) to CI pipelines to detect untrusted-input-to-run: patterns before merge
  • Review permission/allowlist conditionals for null-dereference bypass patterns, e.g. referencing github.event.pull_request.* fields on workflows triggered by issues events where that context never exists

Weaknesses (CWE) in Snowflake GitHub Actions Workflow Injection Exposes Internal

CWE-78, CWE-77

Timeline of Snowflake GitHub Actions Workflow Injection Exposes Internal

  • Original jira_issue.yml logic present in commit 094038e in the snowflake-connector-net repository.
  • PR #1218 merged (squash commit 4a1b8ce), replacing the safe env: + jq --arg parsing pattern with direct ${{ }} expression interpolation inside a run: shell block; GitHub Copilot Autofix reviewed the PR and did not flag the injection.
  • Snowflake merged PR #1402 (commit 1dc7766) the same day, restoring the env: + jq --arg parsing pattern and removing direct expression interpolation.
  • Wiz reported the finding to Snowflake via HackerOne under report #3819931.
  • Red Agent opened a crafted GitHub issue; after an initial payload caused a bash syntax error, it adapted with a payload closing and reopening the shell string to trigger an out-of-band curl callback to an oast.me subdomain, exfiltrating base64-encoded JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN from the Actions runner (egress IP 20.106.182.197).
  • Wiz Research's autonomous Red Agent independently discovered the script-injection flaw and the null-dereference bypass of the github.event.pull_request.user.login allowlist check while probing the public repository.
  • Snowflake rotated the exposed Jira API token belonging to the qa@snowflake.net service account used by the jira_issue.yml workflow.
  • Wiz's 30-day coordinated disclosure window elapsed.
  • The Hacker News, Wiz, and other outlets publicly reported the vulnerability and Wiz's Red Agent research.

Sources cited for Snowflake GitHub Actions Workflow Injection Exposes Internal

More in vulnerability

Detection coverage for TL-2026-2189

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2189 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats