[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDD3BXOLO6CTWjLMXoOBHBsNo-X52YAOlg--gmXT2OtU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":33,"created_at":34,"published_at":35,"article":36,"tags":40,"podcasts":59,"controls":60},"9ce73bca-5ad7-40e0-ba61-ec06e03a69d6","gitlab-email-tokens-enable-unauthorized-code-pushes-via-exposed-addresses","8e112bfa-3140-4f38-b894-6529304f5516","GitLab Email Tokens Enable Unauthorized Code Pushes via Exposed Addresses","GitLab project email addresses, designed for bug report submission, inadvertently contain long-lived authentication tokens that function as credentials — creating a serious access control flaw when exposed publicly. Attackers discovered that simply modifying the '-issue' suffix to '-merge-request' in these addresses allows them to submit merge requests and push code to private repositories, entirely bypassing IP-based restrictions. This matters because long-lived tokens with broad implicit trust effectively become skeleton keys when leaked, enabling source code theft and secrets exposure. The core failure is a combination of poor secret hygiene (publishing email addresses containing tokens) and insufficient token scoping, compounding the risk that no expiration mechanism limits the window of exploitation.","**Immediate actions:**\n- Audit all public-facing documentation, READMEs, and issue trackers to identify and remove any exposed GitLab project email addresses.\n- Immediately reset any compromised or publicly exposed email ingest tokens via GitLab project settings.\n- Disable email-based code submission features on any project that does not explicitly require them.\n\n**Long-term improvements:**\n- Replace long-lived static tokens with short-lived, scoped credentials and enforce automatic token rotation policies.\n- Implement a secrets scanning pipeline (e.g., GitLab Secret Detection, Gitleaks) to detect token leakage in commits, issues, and wikis before they are published.\n- Establish a formal configuration baseline for all GitLab projects that includes required privacy and access settings as part of project provisioning.\n\n**Detection measures:**\n- Enable and monitor GitLab audit logs for unexpected merge requests or code pushes originating from email-based submission channels.\n- Set up alerts for any merge requests submitted via email integration that originate from unrecognized or external senders.\n- Periodically review active project tokens and revoke any that are unused, undocumented, or older than a defined threshold.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 18: Penetration Testing","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","OWASP API Security Top 10: API2 - Broken Authentication","GDPR Article 32: Security of Processing (for EU-hosted repositories containing personal data)",{"CIS Control 5: Account Management":23,"CIS Control 18: Penetration Testing":24,"NIST SP 800-53 AC-6: Least Privilege":25,"NIST SP 800-53 AC-2: Account Management":26,"NIST SP 800-53 CM-6: Configuration Settings":27,"NIST SP 800-53 IA-5: Authenticator Management":28,"OWASP API Security Top 10: API2 - Broken Authentication":29,"NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting":30,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":31,"GDPR Article 32: Security of Processing (for EU-hosted repositories containing personal data)":32},"Account management means knowing which tokens act as credentials and expiring them, so a long-lived token hidden in a project email address does not become a standing key.","Penetration testing that probes alternative uses of exposed addresses, such as swapping '-issue' for '-merge-request', would have found this flaw before attackers did.","Least privilege would limit a bug-report email token to creating issues only, so it could never be repurposed to submit merge requests or push code.","Treating email tokens as managed credentials with owners, scope and expiry would have prevented a leaked bug-report address from granting ongoing push access.","Configuration settings that lock down incoming email handling and enforce IP restrictions consistently would have closed the path that bypassed GitLab's IP-based controls.","Authenticator management requires rotating and limiting the lifetime of tokens, so an email address published years ago would not still carry a working credential.","The flaw is broken authentication in practice: a static token in an email address grants broad actions without proper verification, the weakness this category warns against.","Reviewing audit records for merge requests created by email, especially on private repositories, would surface unexpected pushes made through exposed project addresses.","Secure configuration would disable or restrict GitLab incoming email features that embed tokens, so a public bug-report address could not be turned into a code-push channel.","If leaked repositories held personal data or secrets, failing to control long-lived tokens would undermine the appropriate technical measures that Article 32 requires.","published","2026-09-24T20:21:35.100242+00:00","2026-09-24T20:21:34.81+00:00",{"id":7,"url":37,"slug":38,"title":39},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fexposed-gitlab-project-email-addresses-let-attackers-push-code\u002F","exposed-gitlab-project-email-addresses-let-attackers-push-code-d8d3bf","Exposed GitLab project email addresses let attackers push code",[41,47,53],{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":54,"name":55,"slug":56,"description":57,"color":58},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[61,65,69],{"slug":62,"name":63,"problem":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":66,"name":67,"problem":68},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":70,"name":71,"problem":72},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain."]