Cybersecurity researchers at Wiz disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public repository that allowed attackers to execute commands and access internal Jira credentials through a crafted GitHub issue. The flaw, reported to Snowflake on June 23, 2026, existed in the company's snowflakedb/snowflake-connector-net repository and was patched the same day. The vulnerability stemmed from improper handling of user input in the repository's CI/CD automation, with no affected Snowflake Connector for .NET release identified.
The weakness appeared in the .github/workflows/jira_issue.yml file, which ran automatically when a public issue was opened and exposed JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN to the same workflow step. The workflow inserted attacker-controlled issue title and body values directly into a shell run block without sanitization. During authorized security testing, Wiz's Red Agent system exploited the injection and received an out-of-band callback from the GitHub Actions runner, obtaining the Jira API token. The token belonged to qa@snowflake.net and allowed read access to Jira projects covering engineering, security compliance, and bug bounty tracking on snowflakecomputing.atlassian.net. The vulnerable workflow had reached the default branch on June 18, when pull request #1218 was merged, creating a five-day exposure window before the fix was implemented on June 23.
According to the researchers, Snowflake merged a fix in pull request #1402 on the same day as the report, replacing direct GitHub expression expansion with environment variables passed to jq as arguments. Snowflake said in a statement that "our investigation found no evidence of unauthorized access," and the Jira token was rotated on June 24. Wiz said Snowflake's review found no unrelated external use of the token during the five-day exposure window, though the company's underlying audit logs haven't been made public. As of August 17, 2026, no CVE, CVSS score, or CISA Known Exploited Vulnerabilities catalog entry had been located for the issue, and no connector release update tied to it had been identified.
GitHub had documented this class of workflow injection in July 2025, warning against expanding untrusted issue data directly inside run blocks and recommending the use of intermediate environment variables. The vulnerability resulted from improper input validation in automated workflows, where the system checked github.event.pull_request.user.login even though the event was an issue—meaning the referenced pull request property didn't exist and evaluated to an empty string, allowing ordinary issues to bypass the intended security check. Wiz described the flaw as resulting from a GitHub Copilot Autofix change, though the underlying GitHub history doesn't establish Copilot as the author of the vulnerable jira_issue.yml code. The commit history confirms Copilot participation in pull request #1218 but not authorship of the vulnerable lines.
The corrected handling remains in the repository's master branch, and the vulnerable interpolation is no longer present. The available primary material doesn't establish malicious exploitation in the wild or customer compromise beyond Wiz's authorized security testing. Organizations relying on GitHub Actions for CI/CD automation face persistent tension between development velocity and security rigor, particularly when AI-assisted coding tools participate in workflow design. The incident highlights how credentials embedded in automation pipelines can create brief but significant windows of exposure when input validation fails, even when patches arrive quickly.