Affected Systems

Snowflake's snowflakedb/snowflake-connector-net GitHub repository, specifically the .github/workflows/jira_issue.yml workflow. Vulnerable code was present on the default branch from June 18–23, 2026 (5-day window). No Snowflake Connector for .NET releases were affected; issue confined to CI/CD automation.

Exploitation Status

Exploited during authorized security testing by Wiz Red Agent on June 23, 2026. Researchers obtained Jira API token (qa@snowflake.net) with read access to engineering, security compliance, and bug bounty projects. Snowflake investigation found no evidence of unauthorized access or external use during the 5-day exposure window. No known exploitation in the wild.

Business Impact

The workflow injection allowed execution of arbitrary commands in GitHub Actions runners and exposed internal Jira credentials (JIRA_BASE_URL, JIRA_USER_EMAIL, JIRA_API_TOKEN). Compromised token provided read access to Snowflake's internal Jira projects on snowflakecomputing.atlassian.net, including security compliance and bug bounty tracking. Exposure window was limited to 5 days. No CVE assigned, no CVSS score published. Vulnerability was fixed same day as disclosure (June 23, 2026). No customer data or Snowflake product releases were affected.

Urgency

🟡 Within a week

Recommended Actions

  • Review GitHub Actions workflows in all repositories for direct expansion of untrusted input (github.event.issue.title, github.event.issue.body, etc.) inside run: blocks; refactor to use intermediate environment variables passed as arguments.
  • Audit GitHub Actions audit logs and runner execution logs from June 18–23, 2026, for unexpected issue creation or workflow runs in snowflakedb/snowflake-connector-net repository.
  • Rotate all service account credentials and API tokens used in GitHub Actions workflows, especially those with access to internal ticketing, project management, or CI/CD systems.
  • Implement GitHub Advanced Security code scanning or third-party SAST tools to detect workflow injection patterns before merge to default branch.
  • Enforce mandatory security review for all GitHub Actions workflow changes, particularly those triggered by public events (issues, pull requests from forks).