Breaking
Aktif Kor SISPA dan StraComm Clique, dua mahasiswa USIM raih Anugerah DekanSeat negotiations for Melaka polls will test ‘Malay unity’, says analystTrio fled with jewellery worth RM1.7mil in Genting robberyWhy did Trump scale back war games with South Korea?BYD Atto 3 2026 gets RM14,000 rebate this Merdeka season: Up to RM7,000 off for Sealion 7Malaysian Sprinter Danish Iftikhar Eyes Triple Gold at Sukma 2026World Cup: Speedy Tigers earn first goal after 3-3 draw with France10.0% of Germany’s 20‑to‑24‑year‑olds are neither in training nor employed, EU data show.Haushalte geben im Schnitt knapp ein Zehntel ihrer Konsumausgaben für Freizeit, Sport und Kultur ausLong-awaited trial begins in rapper Tupac Shakur’s 1996 Las Vegas killingWhy bother with a second-class seat at the Security Council?Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command InjectionCash remittances up 1.7% in June, slowest in over 4 yearsForminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP UploadsBSP says it can still take monetary action amid looming inflation risksTrump approval rating falls to 33%, lowest of his presidency, poll findsAtraksi drone perjalanan Indonesia warnai langit di Bundaran HIThe Download: dead robot friends and the “censorship-industrial complex”Pokémon Center data breach exposes customer info, cancels some ordersMicrosoft confirms GitHub is down worldwideAktif Kor SISPA dan StraComm Clique, dua mahasiswa USIM raih Anugerah DekanSeat negotiations for Melaka polls will test ‘Malay unity’, says analystTrio fled with jewellery worth RM1.7mil in Genting robberyWhy did Trump scale back war games with South Korea?BYD Atto 3 2026 gets RM14,000 rebate this Merdeka season: Up to RM7,000 off for Sealion 7Malaysian Sprinter Danish Iftikhar Eyes Triple Gold at Sukma 2026World Cup: Speedy Tigers earn first goal after 3-3 draw with France10.0% of Germany’s 20‑to‑24‑year‑olds are neither in training nor employed, EU data show.Haushalte geben im Schnitt knapp ein Zehntel ihrer Konsumausgaben für Freizeit, Sport und Kultur ausLong-awaited trial begins in rapper Tupac Shakur’s 1996 Las Vegas killingWhy bother with a second-class seat at the Security Council?Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command InjectionCash remittances up 1.7% in June, slowest in over 4 yearsForminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP UploadsBSP says it can still take monetary action amid looming inflation risksTrump approval rating falls to 33%, lowest of his presidency, poll findsAtraksi drone perjalanan Indonesia warnai langit di Bundaran HIThe Download: dead robot friends and the “censorship-industrial complex”Pokémon Center data breach exposes customer info, cancels some ordersMicrosoft confirms GitHub is down worldwide
Economy

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a

Source: The Hacker News · August 17, 2026 at 7:52 PM · AI-assisted report

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Photo: Wikimedia Commons — Snowflake

KUALA LUMPUR, 18 AUGUST 2026 —

Listen to this article

DomainFork Audio · read aloud

KUALA LUMPUR, Aug 17 (Reuters) – Cybersecurity firm Wiz has disclosed a GitHub Actions workflow injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository that could allow attackers to execute commands via a crafted GitHub issue, exposing internal Jira credentials.

Market Impact

The flaw resided in the `.github/workflows/jira_issue.yml` file, which triggered upon the creation of a public GitHub issue. The workflow inadvertently exposed sensitive Jira environment variables—JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN—within a shell execution block. While the vulnerability was confined to the repository’s CI/CD automation, no affected releases of the Snowflake Connector for .NET were identified.

The issue stemmed from improper handling of untrusted GitHub issue data. The workflow directly inserted attacker-controlled issue titles and body content into a `run:` block, enabling command injection. Additionally, the workflow incorrectly referenced `github.event.pull_request.user.login`, a property that does not exist for issue events, though GitHub documentation states such dereferencing evaluates to an empty string.

Wiz’s Red Agent system exploited the flaw during authorized testing. After an initial payload triggered a shell syntax error, the system adjusted its approach and successfully obtained the Jira API token via an out-of-band callback from the GitHub Actions runner. The token, linked to qa@snowflake.net, granted read access to Jira projects covering engineering, security compliance, and bug bounty tracking on snowflakecomputing.atlassian.net.

Snowflake confirmed the token was rotated on June 24, 2026, and stated no unauthorized access was detected during the five-day exposure window.

Wiz reported the issue to Snowflake via HackerOne on June 23, 2026 (report #3819931). Snowflake implemented a fix the same day through pull request #1402, replacing direct GitHub expression expansion with environment variables passed to `jq` as arguments. The vulnerable workflow had been merged into the default branch on June 18, 2026, via pull request #1218. The corrected version remains in the repository’s master branch.

The root cause of the flaw remains unclear. Wiz suggested it may have resulted from a GitHub Copilot Autofix change, though GitHub’s commit history does not explicitly attribute the vulnerable `jira_issue.yml` code to Copilot. A commit on August 25, 2025 (094038e), attributed to sfc-gh-hpathak, introduced the unsafe refactor, while a separate commit (6d0e2fa) modified `jira_close.yml`. Both changes were later included in the June 18 squash merge commit (4a1b8ce), which lists Copilot Autofix among its co-authors.

GitHub had previously warned in July 2025 against expanding untrusted issue data directly in `run:` blocks, recommending the use of intermediate environment variables.

As of August 17, 2026, no CVE identifier, CVSS score, or entry in the CISA Known Exploited Vulnerabilities (KEV) catalog has been assigned to the issue. No connector release updates tied to the flaw have been identified. The vulnerable interpolation is no longer present in the master branch, and available evidence does not indicate malicious exploitation in the wild or customer compromise.

The incident underscores ongoing risks in CI/CD pipelines, particularly as AI-assisted development tools accelerate code generation. GitHub’s documentation continues to emphasize secure handling of untrusted inputs in workflows to prevent similar injection vulnerabilities.

Related: Snowflake · Kuala Lumpur

Reporting based on The Hacker News. Figures and claims are subject to revision as the story develops. DomainFork publishes editorial context, not investment advice — see our editorial standards.