Snowflake fixed a security flaw in a public code repository after Wiz showed that an attacker could steal internal credentials just by opening a crafted GitHub issue. The bug was a script-injection weakness in the GitHub Actions workflow for snowflakedb/snowflake-connector-net that let an unauthenticated user run commands on the workflow runner and exfiltrate a Jira token; Wiz says GitHub Copilot Autofix co-authored the vulnerable change on June 18, Wiz found and reported it on June 23, and Snowflake patched it the same day and rotated the token the next day.
Why it matters: This matters to software teams that rely on GitHub Actions and AI coding assistants, because a small workflow mistake can hand attackers internal credentials and access to engineering systems. Organizations should review GitHub Actions workflows for unsafe input expansion, rotate any exposed secrets, and treat AI-generated CI/CD changes as high-risk code that needs strict review.
SecurityWeek News
2026.08.21
94% relevant
This source adds GitHub's clarification that the vulnerable workflow code in Snowflake's public repository was human-authored and not generated by GitHub Copilot, refining attribution around the same exploited GitHub Actions flaw.
2026.08.17
100% relevant
This article establishes a distinct incident: a real Snowflake repository workflow flaw found and exploited in a sanctioned test, with concrete exposure of Jira credentials and a same-day vendor fix.
← Back to all stories