Researchers from Wiz have disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository. The flaw, located in the .github/workflows/jira_issue.yml workflow, could potentially allow command execution via crafted GitHub issues. The workflow was designed to run on issue activity and contained internal Jira credentials, raising concerns about credential exposure and lateral movement if exploited.

Which products are affected?

snowflake-connector-net, GitHub Actions

What should defenders do?

Organizations using Snowflake's snowflakedb/snowflake-connector-net repository should review GitHub Actions workflows for handling of untrusted input. It is recommended to implement strict input validation, avoid processing sensitive data from issue titles or bodies without sanitization, and rotate any credentials that may have been exposed in the affected workflow. Snowflake has indicated the specific workflow has been remediated.

highvulnerability

Snowflake GitHub Actions Vulnerability Could Allow Command Injection via Crafted Issues

Researchers identify flaw in snowflakedb/snowflake-connector-net repository that may enable command execution through untrusted issue inputs

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Snowflake GitHub Actions Vulnerability Could Allow Command Injection via Crafted Issues

Key Takeaways

Wiz researchers disclosed a GitHub Actions workflow injection vulnerability in Snowflake's snowflakedb/snowflake-connector-net repository.
The flaw resides in .github/workflows/jira_issue.yml and was triggered by issue activity.
The workflow contained internal Jira credentials, potentially exposing them if exploited.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read