Introduction
A recent investigation by cybersecurity experts at Wiz has uncovered a significant vulnerability within Snowflake’s GitHub Actions workflow. This flaw, identified in the snowflakedb/snowflake-connector-net repository, could allow crafted GitHub issues to execute commands that expose internal Jira credentials.
The vulnerability resided in the .github/workflows/jira_issue.yml file, which operated upon the creation of a public issue. This flaw revealed critical information like JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN within the same workflow step. Although the flaw was found in the repository’s CI/CD automation, no official Snowflake Connector for .NET releases were compromised.
Details of the Vulnerability
The issue arose because the workflow directly inserted attacker-controlled data into a shell run: block. It erroneously checked a non-existent pull request property, allowing ordinary issues to reach the job despite comparisons against certain bot users.
Wiz’s Red Agent system was able to exploit this vulnerability during an authorized security test, receiving an out-of-band callback from the GitHub Actions runner. This enabled them to extract the Jira API token, which was linked to [email protected], granting read access to various Jira projects.
Response and Resolution
Wiz notified Snowflake of the issue through HackerOne on June 23, 2026. A swift response followed with the merging of a fix on the same day, which involved replacing direct GitHub expression expansions with environment variables as arguments to jq.
The problematic workflow had been part of the main branch since June 18, following a merged pull request. Snowflake’s statement, shared by Wiz, assured that no unauthorized access had been detected. The Jira token was rotated promptly on June 24, and no external misuse was observed during the exposure period.
Implications and Future Outlook
This security lapse was attributed to a GitHub Copilot Autofix change, although the specific vulnerable code was not directly authored by Copilot. The refactor traced back to a separate commit from August 2025, but was later integrated into a squash merge commit with Copilot involved as a co-author.
GitHub had previously highlighted this type of workflow injection risk, advising against the inclusion of untrusted data in run: blocks. As of August 17, 2026, there had been no CVE or CVSS score assigned, nor any updates to connector releases due to the vulnerability.
Conclusion
This incident underlines the importance of rigorous security measures in software development workflows. While no evidence of malicious exploitation was found, the fast response by Snowflake serves as a reminder of the need for vigilance and quick action in the face of potential cyber threats.
