Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Snowflake snowflakedb/snowflake-connector-net GitHub Actions workflow injection command injection flaw

Vulnerability
First reported
Last updated
Happening score
H score 41
2 unique sources, 2 articles

Summary

Hide ▲

GitHub Actions workflow injection in Snowflake’s public snowflakedb/snowflake-connector-net repository let a crafted GitHub issue trigger arbitrary commands in a runner and exposed internal Jira credentials. Wiz Research said its Red Agent found and exploited the flaw during authorized testing via HackerOne on June 23, 2026; Snowflake patched the workflow the same day in PR #1402. The vulnerable workflow had reached the default branch on June 18, 2026, and Snowflake later rotated the exposed Jira API token on June 24. Snowflake said it found no evidence of unauthorized access, and no CVE, CVSS, or CISA KEV entry had been identified as of August 17, 2026.

Related Happenings

GitHub widespread outage affecting API, Actions, and authentication

Service Disruption
H score0 First: 17.08.2026 17:47 Last: 17.08.2026 17:47 Sources 1

About this happening: The GitHub outage is degrading website, API, Actions, and Pull Requests access for some users, interrupting developer workflows and automated delivery. The dis...

Open Happening

North Korean Contagious Interview PolinRider supply-chain campaign

Campaign
H score51 First: 04.07.2026 14:17 Last: 04.07.2026 14:17 Sources 1

About this happening: The Contagious Interview / PolinRider campaign is still active, with 108 unique packages and browser extensions published across npm, Packagist, Go, and Google Chrome....

Open Happening

GitHub actions/checkout blocks fork pull request checkouts by default in privileged workflows

Security Tool/Service
H score11 First: 23.06.2026 17:22 Last: 23.06.2026 17:22 Sources 1

About this happening: GitHub's actions/checkout now refuses common pwn request patterns by default, cutting the risk of attacker-controlled code execution in privileged GitHub Actions workf...

Open Happening

IronWorm npm supply-chain infection and self-propagation

Malware Activity
H score15 First: 04.06.2026 18:25 Last: 04.06.2026 18:25 Sources 1

About this happening: IronWorm is a Rust infostealer in a npm supply-chain activity that hides behind an eBPF kernel rootkit, communicates over Tor, and targets 86 environment var...

Open Happening

Claude Code GitHub Action bot trigger bypass security flaw

Vulnerability
H score31 First: 04.06.2026 18:15 Last: 04.06.2026 18:15 Sources 1

About this happening: Anthropic's Claude Code GitHub Action had a trigger-check bypass that let a malicious GitHub issue escalate into repository takeover for vulnerable public reposito...

Open Happening

Timeline

  1. 17.08.2026 21:44 1 articles · 13d ago

    Vulnerable Jira workflow reaches Snowflake's default branch

    Technical Analysis Update

    The vulnerable .github/workflows/jira_issue.yml workflow reached the default branch in snowflakedb/snowflake-connector-net on June 18, 2026. It ran when a public issue was opened, exposed JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN in the same workflow step, and checked github.event.pull_request.user.login even though the event was an issue, letting an ordinary issue reach the job.

    Show sources
    Open in new tab
  2. 17.08.2026 21:44 1 articles · 13d ago

    Snowflake rotates the exposed Jira API token

    Mitigation Patch Update

    On June 24, 2026, Snowflake rotated the Jira API token exposed by the workflow. Wiz said the token belonged to [email protected] and allowed read access to Jira projects covering engineering, security compliance, and bug bounty tracking on snowflakecomputing.atlassian.net, while Snowflake said it found no evidence of unauthorized access.

    Show sources
    Open in new tab
  3. 23.06.2026 03:00 3 articles · 2mo ago

    Wiz reports GitHub Actions injection and Snowflake patches the workflow

    Initial Disclosure

    Wiz reported the GitHub Actions workflow injection to Snowflake through HackerOne on June 23, 2026, under report #3819931, and Snowflake merged pull request #1402 that day to replace direct GitHub expression expansion with environment variables passed to jq as arguments. Wiz also said its Red Agent system had triggered the injection during authorized security testing and received an out-of-band callback from the GitHub Actions runner, obtaining the Jira API token used by the workflow.

    Show sources
    Open in new tab