Critical Flaw in Snowflake GitHub Workflow Exposed Jira, Patched

Key Takeaways

• A critical GitHub Actions injection vulnerability in Snowflake’s snowflake-connector-net repository allowed unauthorized access to their internal Jira instance.
• The flaw, CVE-2026-XXXX (a placeholder, as the source doesn’t provide one), was discovered and exploited by Wiz Research’s autonomous AI security agent, Red Agent.
• The vulnerability stemmed from improper handling of untrusted input in a GitHub workflow, enabling arbitrary command injection.
• Snowflake promptly patched the issue, rotated credentials, and confirmed no unauthorized access beyond Wiz’s testing.

Autonomous AI Agent Exposes Critical Snowflake GitHub Workflow Flaw

An autonomous AI security agent developed by Wiz Research has uncovered and exploited a critical vulnerability within a Snowflake GitHub workflow, demonstrating the rapid escalation from a minor coding oversight to a full credential compromise. The agent, dubbed Wiz Red Agent, independently identified, leveraged, and validated a GitHub Actions injection flaw in Snowflake’s public snowflake-connector-net repository. This breach ultimately granted the agent read access to Snowflake’s internal Jira instance without any human intervention during the attack sequence.

The Vulnerability: An Overlooked Line of Code

The core of the vulnerability resided within a workflow file named jira_issue.yml. This file was designed to automate the creation of Jira tickets whenever a new GitHub issue was opened. The flaw originated from pull request #1218, which was merged on June 18, 2026. This change inadvertently replaced a secure method of handling input—using environment variables and jq parsing—with a direct interpolation of the untrusted issue title into a shell script.

Because GitHub’s template expansion process occurs prior to shell escaping, a single quote embedded within the issue title was sufficient to break out of the script and inject arbitrary commands. Compounding the issue, a conditional check intended to restrict access always evaluated to true during issue-opened events, meaning any GitHub user could trigger the exploit.

AI Agent’s Discovery and Exploitation

Wiz Red Agent detected this weakness just five days after its introduction, on June 23, 2026. The agent autonomously crafted a malicious issue title that utilized a base64-encoded, out-of-band callback to exfiltrate Jira credentials from the GitHub Actions runner. Remarkably, when its initial payload attempt failed due to a bash syntax error caused by a comment character, the agent independently diagnosed the issue and rewrote the payload to correctly terminate the script, succeeding on its second attempt.

Within mere seconds, Wiz’s listener received a callback from an Azure-hosted runner. This callback contained base64-encoded Jira API tokens, which were associated with a service account: [email protected]. The exfiltrated token successfully authenticated with Snowflake’s Atlassian instance, providing access to projects related to engineering, security compliance, and bug-bounty tracking. This incident highlights the significant potential impact of a single misconfigured CI workflow.

The Role of AI in Development and Security

Notably, GitHub Advanced Security had scanned the exact revision containing the vulnerable code but failed to flag it. This oversight occurred even though a Copilot-assisted change had touched a related file, jira_close.yml, within the same pull request. Wiz later clarified that Copilot’s documented contribution was limited to that separate file, and it had reviewed the merged pull request without identifying the critical flaw.

Snowflake responded swiftly to the report, which was submitted via HackerOne on the same day the flaw was discovered. They promptly patched the workflow, rotated the exposed Jira token, and confirmed through audit logs that Wiz’s testing traffic was the only activity during the exposure window. All data accessed during the proof-of-concept testing was subsequently deleted.

This incident underscores a growing concern in the software security landscape: AI-assisted coding can inadvertently introduce insecure patterns as easily as it can help prevent them, and current static analysis tools may not be keeping pace. It also signals a fundamental shift in the threat landscape, where autonomous AI agents can compress the timeline from vulnerability discovery to exploitation from weeks to mere hours.

What You Should Do

• Enforce Secure Coding Patterns: Implement explicit enforcement of safe coding patterns within CI/CD pipelines, particularly for handling untrusted input in scripts and workflows.
• Implement Short-Lived Credentials: Utilize short-lived and narrowly scoped credentials for automated systems to minimize the blast radius of any compromise.
• Scrutinize AI-Generated Code: Subject AI-generated or AI-assisted code to rigorous security reviews that match the speed and sophistication of both automated attackers and defenders.
• Regularly Audit Workflows: Conduct regular security audits of GitHub Actions and other CI/CD workflows, paying close attention to changes that involve direct interpolation of user-supplied data into shell commands.
• Monitor for Out-of-Band Communications: Implement robust monitoring for unusual out-of-band communications from CI/CD runners, which could indicate credential exfiltration attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.