Reported by 2 outlets
Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from gbhackers.com
Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials
gbhackers.com · 55d ago · August 20th, 2026
A significant GitHub Actions injection vulnerability in Snowflake’s public snowflake-connector-net repository. This flaw could have allowed unauthenticated attackers to execute commands on a GitHub-hosted runner and potentially steal internal Jira credentials. The vulnerability was discovered by Wiz Red Agent, an autonomous AI-powered security research tool, just five days after the vulnerable workflow was deployed. Snowflake […] The post Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Snowflake GitHub Actions Injection Flaw Exposes Internal Jira Credentials
cyberpress.org · 54d ago · August 20th, 2026
The flaw enabled an unauthenticated GitHub user to execute arbitrary commands on a GitHub Actions runner and exfiltrate credentials for Snowflake’s internal Jira environment. The discovery demonstrates how a small CI/CD coding error can lead to a major credential-exposure incident, particularly when GitHub workflows process attacker-controlled issue or pull request content. Snowflake GitHub Actions Injection Flaw The vulnerability was found in jira_issue.yml , a GitHub Actions workflow designed to automatically create Jira tickets whenever a user opened a GitHub issue. Pull request #1218, merged on June 18, 2026, reportedly replaced a safer implementation that used environment variables and jq parsing with direct interpolation of the untrusted issue title into a shell script. This change created a command-injection opportunity. GitHub Actions expressions are expanded before shell escaping takes effect, allowing an attacker to use a specially crafted issue title containing a single quote to terminate the intended string and inject arbitrary Bash commands. Screenshot demonstrating access to Snowflake’s Jira portal, via an exfiltrated token (Source: Wiz) A conditional check intended to limit workflow execution also reportedly evaluated as true for issues.opened events. Consequently, any GitHub user able to open an i