Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Snowflake snowflakedb/snowflake-connector-net GitHub Actions workflow injection command injection flaw

Vulnerability
First reported
Last updated
Happening score
H score 41
1 unique sources, 1 articles

Summary

Hide ▲

Wiz disclosed a GitHub Actions workflow injection in Snowflake’s public snowflakedb/snowflake-connector-net repository that could let a crafted GitHub issue execute commands and expose internal Jira credentials. The vulnerable automation sat in .github/workflows/jira_issue.yml and was confined to the repository’s CI/CD workflow. Snowflake merged a fix on June 23, 2026, and no affected connector release was identified. As of August 17, 2026, no CVE, CVSS, or CISA KEV entry had been identified.

Related Happenings

GitHub widespread outage affecting API, Actions, and authentication

Service Disruption
H score0 First: 17.08.2026 17:47 Last: 17.08.2026 17:47 Sources 1

About this happening: The GitHub outage is degrading website, API, Actions, and Pull Requests access for some users, interrupting developer workflows and automated delivery. The dis...

Open Happening

GitHub actions/checkout blocks fork pull request checkouts by default in privileged workflows

Security Tool/Service
H score11 First: 23.06.2026 17:22 Last: 23.06.2026 17:22 Sources 1

About this happening: GitHub's actions/checkout now refuses common pwn request patterns by default, cutting the risk of attacker-controlled code execution in privileged GitHub Actions workf...

Open Happening

Claude Code GitHub Action bot trigger bypass security flaw

Vulnerability
H score31 First: 04.06.2026 18:15 Last: 04.06.2026 18:15 Sources 1

About this happening: Anthropic's Claude Code GitHub Action had a trigger-check bypass that let a malicious GitHub issue escalate into repository takeover for vulnerable public reposito...

Open Happening

Miasma GitHub and npm supply-chain campaign

Campaign
H score26 First: 02.06.2026 00:38 Last: 02.06.2026 00:38 Sources 1

About this happening: Miasma is a supply-chain campaign that began in Red Hat's @redhat-cloud-services npm namespace and later expanded across npm, PyPI, the Go ecosystem, and Git...

Latest development: 05.06.2026 21:05

A new Miasma wave is linked to 57 compromised npm packages across more than 286 malicious versions, with malicious installs abusing a 157-byte binding.gyp file for code execution during npm install and then staging additional payloads that inject persistent backdoor files into project repositories and target AI-assisted IDE workflows.

Open Happening

Actions-cool/issues-helper hit by network compromise

Incident
H score45 First: 19.05.2026 08:28 Last: 19.05.2026 08:28 Sources 1

About this happening: The actions-cool/issues-helper GitHub Actions supply-chain compromise let malicious tags run in CI/CD pipelines, causing credential theft and downstream account risk....

Open Happening

Timeline

  1. 17.08.2026 21:44 1 articles · 3h ago

    Vulnerable Jira workflow reaches Snowflake's default branch

    Technical Analysis Update

    The vulnerable .github/workflows/jira_issue.yml workflow reached the default branch in snowflakedb/snowflake-connector-net on June 18, 2026. It ran when a public issue was opened, exposed JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN in the same workflow step, and checked github.event.pull_request.user.login even though the event was an issue, letting an ordinary issue reach the job.

    Show sources
    Open in new tab
  2. 17.08.2026 21:44 1 articles · 3h ago

    Snowflake rotates the exposed Jira API token

    Mitigation Patch Update

    On June 24, 2026, Snowflake rotated the Jira API token exposed by the workflow. Wiz said the token belonged to [email protected] and allowed read access to Jira projects covering engineering, security compliance, and bug bounty tracking on snowflakecomputing.atlassian.net, while Snowflake said it found no evidence of unauthorized access.

    Show sources
    Open in new tab
  3. 23.06.2026 03:00 2 articles · 1mo ago

    Wiz reports GitHub Actions injection and Snowflake patches the workflow

    Initial Disclosure

    Wiz reported the GitHub Actions workflow injection to Snowflake through HackerOne on June 23, 2026, under report #3819931, and Snowflake merged pull request #1402 that day to replace direct GitHub expression expansion with environment variables passed to jq as arguments. Wiz also said its Red Agent system had triggered the injection during authorized security testing and received an out-of-band callback from the GitHub Actions runner, obtaining the Jira API token used by the workflow.

    Show sources
    Open in new tab