Snowflake GitHub Actions Workflow Injection Exposes Internal Jira Credentials

Key facts for Snowflake GitHub Actions JIRA leak

Detection coverage for Snowflake GitHub Actions JIRA leak

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2189 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Outbound Request to Interactsh-Class OOB Interaction Domain with Long Encoded Query String (SPL)

Detects an outbound HTTP request from a CI/CD runner or corporate egress point to a known out-of-band interaction service domain (oast.me, interact.sh, oastify.com, burpcollaborator.net, canarytokens.com, webhook.site) carrying an unusually long query string, matching the base64-encoded credential exfiltration callback pattern used to steal JIRA_API_TOKEN/JIRA_USER_EMAIL/JIRA_BASE_URL from Snowflake's jira_issue.yml Actions runner.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1132.001, T1567
• Data sources: azure_nsg_flow_logs, proxy_logs, dns_query_logs, github_actions_runner_network_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=network
| where like(dest_host,"%.oast.me") OR like(dest_host,"%.interact.sh") OR like(dest_host,"%.oastify.com") OR like(dest_host,"%.burpcollaborator.net") OR like(dest_host,"%.canarytokens.com") OR like(dest_host,"%.webhook.site")
| eval query_len=len(url_query)
| where query_len > 40
| table _time src_ip dest_host dest_ip url uri_query http_method bytes_out
| sort -_time

Microsoft KQL

AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestinationHost_s endswith ".oast.me" or DestinationHost_s endswith ".interact.sh" or DestinationHost_s endswith ".oastify.com" or DestinationHost_s endswith ".burpcollaborator.net" or DestinationHost_s endswith ".canarytokens.com" or DestinationHost_s endswith ".webhook.site"
| where strlen(RequestURI_s) > 40
| project TimeGenerated, SourceIP_s, DestinationHost_s, DestinationIP_s, RequestURI_s, HttpMethod_s, BytesSent_d

Sigma

title: Outbound HTTP Request to Interactsh-Class Out-of-Band Interaction Domain with Long Encoded Query String
id: c58d3a2b-1f4e-4d99-9c3b-7e8f90123456
status: experimental
description: Detects an outbound HTTP/DNS request from a CI/CD runner or corporate egress point to a known out-of-band interaction service domain (oast.me, interact.sh, burpcollaborator.net, canarytokens.com, webhook.site) matching the base64-encoded credential exfiltration callback pattern used against Snowflake's jira_issue.yml workflow.
references:
    - https://docs.github.com/en/actions/concepts/security/script-injections
    - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - attack.exfiltration
    - attack.t1567
logsource:
    category: proxy
    product: network
detection:
    selection_domain:
        c-uri|endswith:
            - '.oast.me'
            - '.interact.sh'
            - '.oastify.com'
            - '.burpcollaborator.net'
            - '.canarytokens.com'
            - '.webhook.site'
    condition: selection_domain
falsepositives:
    - Authorized penetration-testing or bug-bounty red-team OOB validation traffic (e.g. Wiz's own sanctioned Red Agent engagement) — corroborate against an approved testing calendar
    - Security tooling (DAST/SSRF scanners) intentionally configured to beacon to interact.sh/oast.me for blind vulnerability confirmation
level: critical

Known false positives:

• Authorized penetration-testing or bug-bounty red-team OOB validation traffic (e.g. Wiz's own sanctioned Red Agent engagement) — corroborate against an approved testing calendar
• Security tooling (DAST/SSRF scanners) intentionally configured to beacon to interact.sh/oast.me for blind vulnerability confirmation

Tuning notes: Maintain and periodically refresh the OOB-domain list against current Interactsh-class services (they rotate domains, e.g. oast.pro/oast.fun/oast.live); allow-list authorized red-team source IP ranges and sanctioned testing windows to suppress expected engagements like Wiz's Red Agent.

• 🔒 GitHub Issue Title/Body Contains Shell Injection Metacharacters (KQL) · unlock with TL Creds
• 🔒 Secret Environment Variable Referenced Alongside Outbound HTTP Client in Workflow Run Log (KQL) · unlock with TL Creds
• 🔒 Outbound Request to Interactsh-Class OOB Interaction Domain with Long Encoded Query String (KQL) · unlock with TL Creds
• 🔒 GitHub Issue Title/Body Contains Shell Injection Metacharacters (Sigma) · unlock with TL Creds
• 🔒 Secret Environment Variable Referenced Alongside Outbound HTTP Client in Workflow Run Log (Sigma) · unlock with TL Creds
• 🔒 Outbound Request to Interactsh-Class OOB Interaction Domain with Long Encoded Query String (Sigma) · unlock with TL Creds
• 🔒 GitHub Issue Title/Body Contains Shell Injection Metacharacters (SPL) · unlock with TL Creds
• 🔒 Secret Environment Variable Referenced Alongside Outbound HTTP Client in Workflow Run Log (SPL) · unlock with TL Creds

Indicators of compromise for Snowflake GitHub Actions JIRA leak

As of 2026-08-28, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2189.

Sample indicators (3 of 13)

• IP address: 20.106.182[.]197
• Domain: oast[.]me
• Domain: snowflakecomputing[.]atlassian[.]net

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How Snowflake GitHub Actions JIRA leak works

Wiz Research's autonomous Red Agent independently discovered and exploited the bug during authorized testing, reported it via HackerOne, and Snowflake patched and rotated the token within a day.

The snowflakedb/snowflake-connector-net repository's .github/workflows/jira_issue.yml workflow ran on public `issues` events and interpolated the untrusted `github.event.issue.title` value directly into a bash string (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`) before any shell escaping occurred. A guard condition intended to restrict execution — `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'` — was structurally broken: on `issues` events `github.event.pull_request` never exists, so GitHub Actions evaluates the dereference as an empty string, making the condition always true and allowing any unauthenticated GitHub user to trigger the workflow with attacker-controlled input.

The unsafe pattern was reintroduced on 2026-06-18 when PR #1218 (squash commit 4a1b8ce) replaced an earlier safe `env:` + `jq --arg` parsing approach (traceable to commit 094038e from 2025-08-25) with direct `${{ }}` expression interpolation inside a `run:` block. GitHub Copilot Autofix reviewed the final revision of PR #1218 and did not flag the injection.

Wiz Research's autonomous Red Agent system discovered the flaw on 2026-06-23 while probing the public repository, and exploited it without human intervention: an initial payload using a `#` comment character caused a bash syntax error by consuming the closing parenthesis of `TITLE=$(...)`, and the agent adapted by crafting a payload that closed and reopened the quoted string (`'; curl ...; echo '`) to inject a valid shell command. The final payload issued a `curl` call to an attacker-controlled `oast.me` subdomain (an Interactsh-class out-of-band interaction service) with `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` base64-encoded into the URL query string, exfiltrating them from the GitHub-hosted Actions runner (egress IP 20.106.182.197, Azure-hosted).

The exfiltrated token belonged to a Jira service account (qa@snowflake.net) with read access to snowflakecomputing.atlassian.net projects covering engineering, security compliance, and bug-bounty tracking. Wiz reported the finding to Snowflake via HackerOne (report #3819931) the same day it was found; Snowflake merged a fix (PR #1402, commit 1dc7766) restoring the `env:` + `jq --arg` pattern within hours, and rotated the exposed Jira token on 2026-06-24. Snowflake's investigation found no evidence the flaw was exploited by anyone other than Wiz's authorized Red Agent, and no snowflake-connector-net package releases were affected — the vulnerability was confined to the repository's CI/CD workflow configuration.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1132.001 Data Encoding: Standard Encoding

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Credential Access

T1552 Unsecured Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1594 Search Victim-Owned Websites

Remediation for Snowflake GitHub Actions JIRA leak

Patches

• PR #1402 / commit 1dc7766 — restores env: + jq --arg parsing in .github/workflows/jira_issue.yml

Immediate actions

• Rotate any secrets (JIRA_API_TOKEN, JIRA_USER_EMAIL, JIRA_BASE_URL) previously exposed to the jira_issue.yml workflow step — completed by Snowflake on 2026-06-24
• Audit all GitHub Actions workflows for direct ${{ github.event.* }} expression interpolation inside run: shell blocks, especially on issues/issue_comment/pull_request_target triggers

Workarounds

• Restrict workflows triggered by public-facing events (issues, issue_comment) from running with access to repository secrets until all interpolated inputs are routed through intermediate environment variables

Longer-term hardening

• Adopt the environment-variable + native-argument parsing pattern (env: block followed by jq --arg or shell positional parameters) instead of inline expression expansion for any workflow triggered by public/untrusted events
• Add CI linting (e.g. actionlint, zizmor) to CI pipelines to detect untrusted-input-to-run: patterns before merge
• Review permission/allowlist conditionals for null-dereference bypass patterns, e.g. referencing github.event.pull_request.* fields on workflows triggered by issues events where that context never exists

Affected and fixed versions

• Snowflake Inc. — snowflake-connector-net (GitHub Actions CI/CD workflow: .github/workflows/jira_issue.yml)
  Vulnerable versions: Workflow config from commit 4a1b8ce (PR #1218, merged 2026-06-18) through 2026-06-23
  Fixed in: Workflow config from commit 1dc7766 (PR #1402, merged 2026-06-23) onward

Timeline of Snowflake GitHub Actions JIRA leak

• 2025-08-25 Original jira_issue.yml logic present in commit 094038e in the locked-ioc-4 repository.
• 2026-06-18 PR #1218 merged (squash commit 4a1b8ce), replacing the safe env: + jq --arg parsing pattern with direct ${{ }} expression interpolation inside a run: shell block; locked-ioc-5 reviewed the PR and did not flag the injection.
• 2026-06-23 Snowflake merged PR #1402 (commit 1dc7766) the same day, restoring the env: + jq --arg parsing pattern and removing direct expression interpolation.
• 2026-06-23 Wiz reported the finding to Snowflake via locked-ioc-12 under report #3819931.
• 2026-06-23 Red Agent opened a crafted GitHub issue; after an initial payload caused a bash syntax error, it adapted with a payload closing and reopening the shell string to trigger an out-of-band curl callback to an locked-ioc-13 subdomain, exfiltrating base64-encoded JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN from the Actions runner (egress IP locked-ioc-8).
• 2026-06-23 Wiz Research's autonomous Red Agent independently discovered the script-injection flaw and the null-dereference bypass of the github.event.pull_request.user.login allowlist check while probing the public repository.
• 2026-06-24 Snowflake rotated the exposed Jira API token belonging to the locked-ioc-6 service account used by the jira_issue.yml workflow.
• 2026-07-25 Wiz's 30-day coordinated disclosure window elapsed.
• 2026-08-17 The Hacker News, Wiz, and other outlets publicly reported the vulnerability and Wiz's Red Agent research.

Sources cited for Snowflake GitHub Actions JIRA leak

• Red Agent Exploits Snowflake Vuln Missed by Github Copilot Wiz · Vendor report · 2026-08-17
• Script injections GitHub · Vendor report · 2026-08-17
• Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection The Hacker News · News · 2026-08-17
• Wiz AI Agent Finds Critical Snowflake GitHub Repo Flaw Advanced Security Missed infosecurity-magazine.com · News · 2026-08-17
• Wiz agent finds Snowflake repo flaw in code co-authored by GitHub Copilot Autofix scworld.com · News · 2026-08-17
• Wiz's AI Agent Finds A Vulnerability In Snowflake's Internal Systems forbes.com · News · 2026-08-17
• AI Agent Hacks Snowflake GitHub Workflow and Reaches Internal Jira cybersecuritynews.com · News · 2026-08-17
• Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials gbhackers.com · News · 2026-08-17

Threats related to Snowflake GitHub Actions JIRA leak

• GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials
• GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets Attackers Execute Server Commands
• CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing
• Critical Meta IDOR Flaw in Support Case Infrastructure Exposed Customer Emails, Transcripts, and Internal Notes (Meta Horizon Managed Solutions / Meta.com Support)
• Claude-Powered AI Agent (OpenClaw) Autonomously Exploits Broken Access Control Flaw in Gym Booking API

Related coverage of this activity

• Wiz Red Agent airline BOLA
• KDDI shared mail platform breach
• Buffa Rust protobuf DoS
• Elementor Pro upload RCE
• LiteLLM BadHost chain RCE