Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Summary: Wiz researchers disclosed a GitHub Actions workflow injection flaw in Snowflake's public snowflakedb/snowflake-connector-net repository, where .github/workflows/jira_issue.yml inserted attacker-controlled issue title and body values directly into a shell run: block and exposed JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN to that same step. During authorized testing, Wiz's Red Agent obtained a callback from the GitHub Actions runner and the Jira API token belonging to qa@snowflake.net, which allowed read access to engineering, security compliance, and bug bounty Jira projects on snowflakecomputing.atlassian.net; Snowflake merged a fix on June 23, 2026, in pull request #1402 and said its investigation found no evidence of unauthorized access.
What's compelling: A single workflow step that expanded an untrusted issue title into a shell command handed over a Jira token with read access to security compliance and bug bounty tracking - and the vulnerable workflow had been on the default branch for five days before the fix landed.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026