# Snowflake GitHub Actions Workflow Injection Exposes Internal Jira Credentials

> A script-injection flaw in Snowflake's public snowflake-connector-net repository (.github/workflows/jira_issue.yml) let an unauthenticated actor who opened a crafted GitHub issue break out of a shell string, bypass a broken bot-allowlist check, and exfiltrate the workflow's live JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN secrets via an out-of-band HTTP callback. Wiz Research's autonomous Red Agent independently discovered and exploited the bug during authorized testing, reported it via HackerOne, and Snowflake patched and rotated the token within a day.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2189
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-snowflake-github-actions-jira-leak-tl-2026-2189.webp?v=1e435210 (Threadlinqs threat intel: Snowflake Workflow JIRA Leak: Exploitation Status & Fix (TL-2026-2189) — High severity, 13 IOCs, 9 detection rules.)
- **ID:** TL-2026-2189
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)

## Description

The snowflakedb/snowflake-connector-net repository's .github/workflows/jira_issue.yml workflow ran on public `issues` events and interpolated the untrusted `github.event.issue.title` value directly into a bash string (`TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)`) before any shell escaping occurred. A guard condition intended to restrict execution — `github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'` — was structurally broken: on `issues` events `github.event.pull_request` never exists, so GitHub Actions evaluates the dereference as an empty string, making the condition always true and allowing any unauthenticated GitHub user to trigger the workflow with attacker-controlled input.

The unsafe pattern was reintroduced on 2026-06-18 when PR #1218 (squash commit 4a1b8ce) replaced an earlier safe `env:` + `jq --arg` parsing approach (traceable to commit 094038e from 2025-08-25) with direct `${{ }}` expression interpolation inside a `run:` block. GitHub Copilot Autofix reviewed the final revision of PR #1218 and did not flag the injection.

Wiz Research's autonomous Red Agent system discovered the flaw on 2026-06-23 while probing the public repository, and exploited it without human intervention: an initial payload using a `#` comment character caused a bash syntax error by consuming the closing parenthesis of `TITLE=$(...)`, and the agent adapted by crafting a payload that closed and reopened the quoted string (`'; curl ...; echo '`) to inject a valid shell command. The final payload issued a `curl` call to an attacker-controlled `oast.me` subdomain (an Interactsh-class out-of-band interaction service) with `JIRA_API_TOKEN`, `JIRA_USER_EMAIL`, and `JIRA_BASE_URL` base64-encoded into the URL query string, exfiltrating them from the GitHub-hosted Actions runner (egress IP 20.106.182.197, Azure-hosted).

The exfiltrated token belonged to a Jira service account (qa@snowflake.net) with read access to snowflakecomputing.atlassian.net projects covering engineering, security compliance, and bug-bounty tracking. Wiz reported the finding to Snowflake via HackerOne (report #3819931) the same day it was found; Snowflake merged a fix (PR #1402, commit 1dc7766) restoring the `env:` + `jq --arg` pattern within hours, and rotated the exposed Jira token on 2026-06-24. Snowflake's investigation found no evidence the flaw was exploited by anyone other than Wiz's authorized Red Agent, and no snowflake-connector-net package releases were affected — the vulnerability was confined to the repository's CI/CD workflow configuration.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1132.001 Data Encoding: Standard Encoding
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outbound Request to Interactsh-Class OOB Interaction Domain with Long Encoded Query String (SPL)** (`TL-2026-2189-SPL-003`)

Detects an outbound HTTP request from a CI/CD runner or corporate egress point to a known out-of-band interaction service domain (oast.me, interact.sh, oastify.com, burpcollaborator.net, canarytokens.com, webhook.site) carrying an unusually long query string, matching the base64-encoded credential exfiltration callback pattern used to steal JIRA_API_TOKEN/JIRA_USER_EMAIL/JIRA_BASE_URL from Snowflake's jira_issue.yml Actions runner.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1132.001, T1567
- **Data sources:** azure_nsg_flow_logs, proxy_logs, dns_query_logs, github_actions_runner_network_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=network
| where like(dest_host,"%.oast.me") OR like(dest_host,"%.interact.sh") OR like(dest_host,"%.oastify.com") OR like(dest_host,"%.burpcollaborator.net") OR like(dest_host,"%.canarytokens.com") OR like(dest_host,"%.webhook.site")
| eval query_len=len(url_query)
| where query_len > 40
| table _time src_ip dest_host dest_ip url uri_query http_method bytes_out
| sort -_time
```

### Microsoft KQL

```kql
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestinationHost_s endswith ".oast.me" or DestinationHost_s endswith ".interact.sh" or DestinationHost_s endswith ".oastify.com" or DestinationHost_s endswith ".burpcollaborator.net" or DestinationHost_s endswith ".canarytokens.com" or DestinationHost_s endswith ".webhook.site"
| where strlen(RequestURI_s) > 40
| project TimeGenerated, SourceIP_s, DestinationHost_s, DestinationIP_s, RequestURI_s, HttpMethod_s, BytesSent_d
```

### Sigma

```yaml
title: Outbound HTTP Request to Interactsh-Class Out-of-Band Interaction Domain with Long Encoded Query String
id: c58d3a2b-1f4e-4d99-9c3b-7e8f90123456
status: experimental
description: Detects an outbound HTTP/DNS request from a CI/CD runner or corporate egress point to a known out-of-band interaction service domain (oast.me, interact.sh, burpcollaborator.net, canarytokens.com, webhook.site) matching the base64-encoded credential exfiltration callback pattern used against Snowflake's jira_issue.yml workflow.
references:
    - https://docs.github.com/en/actions/concepts/security/script-injections
    - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - attack.exfiltration
    - attack.t1567
logsource:
    category: proxy
    product: network
detection:
    selection_domain:
        c-uri|endswith:
            - '.oast.me'
            - '.interact.sh'
            - '.oastify.com'
            - '.burpcollaborator.net'
            - '.canarytokens.com'
            - '.webhook.site'
    condition: selection_domain
falsepositives:
    - Authorized penetration-testing or bug-bounty red-team OOB validation traffic (e.g. Wiz's own sanctioned Red Agent engagement) — corroborate against an approved testing calendar
    - Security tooling (DAST/SSRF scanners) intentionally configured to beacon to interact.sh/oast.me for blind vulnerability confirmation
level: critical
```

**Known false positives:**

- Authorized penetration-testing or bug-bounty red-team OOB validation traffic (e.g. Wiz's own sanctioned Red Agent engagement) — corroborate against an approved testing calendar
- Security tooling (DAST/SSRF scanners) intentionally configured to beacon to interact.sh/oast.me for blind vulnerability confirmation

**Tuning notes:** Maintain and periodically refresh the OOB-domain list against current Interactsh-class services (they rotate domains, e.g. oast.pro/oast.fun/oast.live); allow-list authorized red-team source IP ranges and sanctioned testing windows to suppress expected engagements like Wiz's Red Agent.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GitHub Issue Title/Body Contains Shell Injection Metacharacters (KQL) (locked: unlock with TL Creds)
- Secret Environment Variable Referenced Alongside Outbound HTTP Client in Workflow Run Log (KQL) (locked: unlock with TL Creds)
- Outbound Request to Interactsh-Class OOB Interaction Domain with Long Encoded Query String (KQL) (locked: unlock with TL Creds)
- GitHub Issue Title/Body Contains Shell Injection Metacharacters (Sigma) (locked: unlock with TL Creds)
- Secret Environment Variable Referenced Alongside Outbound HTTP Client in Workflow Run Log (Sigma) (locked: unlock with TL Creds)
- Outbound Request to Interactsh-Class OOB Interaction Domain with Long Encoded Query String (Sigma) (locked: unlock with TL Creds)
- GitHub Issue Title/Body Contains Shell Injection Metacharacters (SPL) (locked: unlock with TL Creds)
- Secret Environment Variable Referenced Alongside Outbound HTTP Client in Workflow Run Log (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- IP address: `20.106.182[.]197`
- Domain: `oast[.]me`
- Domain: `snowflakecomputing[.]atlassian[.]net`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection](https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets_0330881554.html)
- [Red Agent Exploits Snowflake Vuln Missed by Github Copilot](https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug)
- [Script injections](https://docs.github.com/en/actions/concepts/security/script-injections)
- [Wiz AI Agent Finds Critical Snowflake GitHub Repo Flaw Advanced Security Missed](https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/)
- [Wiz agent finds Snowflake repo flaw in code co-authored by GitHub Copilot Autofix](https://www.scworld.com/news/wiz-agent-finds-snowflake-repo-flaw-in-code-co-authored-by-github-copilot-autofix)
- [Wiz's AI Agent Finds A Vulnerability In Snowflake's Internal Systems](https://www.forbes.com/sites/timkeary/2026/08/17/github-copilot-missed-a-vulnerability-that-wizs-ai-agent-found/)
- [AI Agent Hacks Snowflake GitHub Workflow and Reaches Internal Jira](https://cybersecuritynews.com/ai-agent-hacks-snowflake-github-workflow/)
- [Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials](https://gbhackers.com/critical-snowflake-github-actions-flaw/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2189