Snowflake GitHub Actions Flaw Exposed Jira Token via Issue Injection

Cybersecurity researchers at Wiz have disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that could be exploited through a crafted GitHub issue to execute commands and access internal Jira credentials. The flaw resided in the .github/workflows/jira_issue.yml workflow, which triggered when any public issue was opened and exposed three secrets in the same step: JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN. The workflow inserted attacker-controlled issue title and body values directly into a shell `run:` block, a textbook command injection pattern that allowed arbitrary execution on the GitHub Actions runner.

Wiz's Red Agent AI system successfully exploited the injection during authorized security testing. After the first payload produced a shell syntax error, the agent adapted its approach and subsequently received an out-of-band callback from the runner, exfiltrating the Jira API token. According to Wiz, the token belonged to qa@snowflake.net and granted read access to Jira projects covering engineering, security compliance, and bug bounty tracking on snowflakecomputing.atlassian.net. Organizations that suspect credential reuse across internal services can audit exposed secrets with a password checker and verify exposure by running their domains through an email breach checker.

The vulnerable workflow had reached the default branch on June 18, when pull request #1218 was merged, giving attackers a five-day exposure window. Wiz reported the issue to Snowflake through HackerOne on June 23 (report #3819931), and Snowflake merged a fix the same day in pull request #1402, replacing direct GitHub expression expansion with environment variables passed to jq as arguments. The Jira token was rotated on June 24, and Snowflake stated that its review found no evidence of unauthorized access or unrelated external use of the credential during the exposure period.

Wiz attributed the flaw to a GitHub Copilot Autofix change, though the underlying commit history complicates that narrative. The explicit Copilot co-authored commit, 6d0e2fa, modified jira_close.yml, while the unsafe jira_issue.yml refactor appears in a separate August 25, 2025 commit, 094038e, attributed to user sfc-gh-hpathak. The workflow also contained a logic error, checking github.event.pull_request.user.login on an issue event rather than on a pull request, meaning the bot filter intended to block malicious actors never actually fired. Defenders running port scanner checks against their CI/CD runners and auditing outbound egress from build environments remain essential hardening steps against similar injection flaws.