A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
Leaked GitLab email tokens allow unauthorized code commits and CI/CD job execution.
A vulnerability in GitLab's email issue feature allows attackers to gain access to a user's private email token. This token can be used to commit code, create branches, and trigger CI/CD jobs as the legitimate user, bypassing 2FA and IP restrictions. The severity depends on the user's role, with Maintainer accounts posing a higher risk.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitLab?
Get an email when a new story names GitLab, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA flaw in GitLab's email-to-issue feature exposes per-user email tokens that, once leaked, allow an attacker to impersonate the victim entirely — committing code, creating branches, and triggering CI/CD pipelines without needing their password or passing 2FA. The root cause is that a sensitive authentication token was embedded in an email address that could be inadvertently exposed through forwarded emails, mailing list archives, or misconfigured mail clients. This is particularly dangerous because the token bypasses multiple layers of security controls that organizations rely on, including two-factor authentication and IP allowlisting. The risk escalates significantly for privileged accounts such as Maintainers, where an attacker could silently inject malicious code into production pipelines.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.