Cybersecurity researchers at Wiz discovered a workflow injection vulnerability in a Snowflake GitHub repository that could have allowed attackers to steal internal Jira credentials via malicious issue submissions.

Key Points

• The vulnerability existed in the jira_issue.yml workflow within the snowflakedb/snowflake-connector-net repository.
• Attackers could exploit the flaw by injecting crafted titles or bodies into GitHub issues to execute unauthorized commands.
• Wiz researchers successfully obtained a Jira API token belonging to qa@snowflake.net during authorized security testing.
• Snowflake patched the issue on June 23, 2026, by replacing direct expression expansion with secure environment variables.
• Snowflake confirmed that an internal investigation found no evidence of unauthorized access or malicious exploitation of the exposed token.

Why it Matters

This incident highlights the significant security risks associated with improper handling of untrusted input within automated CI/CD pipelines. It serves as a critical reminder for developers to follow GitHub’s security guidelines by using intermediate environment variables rather than direct expression expansion to prevent command injection.