[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLVFm2l_g5YJeoiZmB08otrw-nPgIpnMPzufqij67EM8":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"8e112bfa-3140-4f38-b894-6529304f5516","Exposed GitLab project email addresses let attackers push code","exposed-gitlab-project-email-addresses-let-attackers-push-code-d8d3bf","Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. [...]","Attackers are exploiting exposed private GitLab email addresses, intended for submitting bug reports, to push code, steal source code, and access secrets in private repositories. These email addresses contain long-lived tokens that act as credentials, and attackers can modify the '-issue' suffix to '-merge-request' to submit merge requests, bypassing IP restrictions. While GitLab has updated its UI and documentation, project maintainers are urged to stop exposing these addresses and reset compromised tokens.","Exposed GitLab project email addresses allow attackers to push code and access private repositories.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fexposed-gitlab-project-email-addresses-let-attackers-push-code\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F05\u002F01\u002FGitLab.jpg","2026-09-24T17:47:44+00:00","2026-09-24T20:00:23.823705+00:00",8,[17,20],{"name":18,"type":19},"GitLab","product",{"name":21,"type":22},"Aikido","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":80,"name":81,"problem":82,"products":83},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":109,"name":110,"problem":111,"products":112},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":153},"gitlab-email-tokens-enable-unauthorized-code-pushes-via-exposed-addresses","GitLab Email Tokens Enable Unauthorized Code Pushes via Exposed Addresses","GitLab project email addresses, designed for bug report submission, inadvertently contain long-lived authentication tokens that function as credentials — creating a serious access control flaw when exposed publicly. Attackers discovered that simply modifying the '-issue' suffix to '-merge-request' in these addresses allows them to submit merge requests and push code to private repositories, entirely bypassing IP-based restrictions. This matters because long-lived tokens with broad implicit trust effectively become skeleton keys when leaked, enabling source code theft and secrets exposure. The core failure is a combination of poor secret hygiene (publishing email addresses containing tokens) and insufficient token scoping, compounding the risk that no expiration mechanism limits the window of exploitation.",[143,144,145,146,147,148,149,150,151,152],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 18: Penetration Testing","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","OWASP API Security Top 10: API2 - Broken Authentication","GDPR Article 32: Security of Processing (for EU-hosted repositories containing personal data)",{"CIS Control 5: Account Management":154,"CIS Control 18: Penetration Testing":155,"NIST SP 800-53 AC-6: Least Privilege":156,"NIST SP 800-53 AC-2: Account Management":157,"NIST SP 800-53 CM-6: Configuration Settings":158,"NIST SP 800-53 IA-5: Authenticator Management":159,"OWASP API Security Top 10: API2 - Broken Authentication":160,"NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting":161,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":162,"GDPR Article 32: Security of Processing (for EU-hosted repositories containing personal data)":163},"Account management means knowing which tokens act as credentials and expiring them, so a long-lived token hidden in a project email address does not become a standing key.","Penetration testing that probes alternative uses of exposed addresses, such as swapping '-issue' for '-merge-request', would have found this flaw before attackers did.","Least privilege would limit a bug-report email token to creating issues only, so it could never be repurposed to submit merge requests or push code.","Treating email tokens as managed credentials with owners, scope and expiry would have prevented a leaked bug-report address from granting ongoing push access.","Configuration settings that lock down incoming email handling and enforce IP restrictions consistently would have closed the path that bypassed GitLab's IP-based controls.","Authenticator management requires rotating and limiting the lifetime of tokens, so an email address published years ago would not still carry a working credential.","The flaw is broken authentication in practice: a static token in an email address grants broad actions without proper verification, the weakness this category warns against.","Reviewing audit records for merge requests created by email, especially on private repositories, would surface unexpected pushes made through exposed project addresses.","Secure configuration would disable or restrict GitLab incoming email features that embed tokens, so a public bug-report address could not be turned into a code-push channel.","If leaked repositories held personal data or secrets, failing to control long-lived tokens would undermine the appropriate technical measures that Article 32 requires."]