GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories
Aikido says a leaked GitLab incoming-email token can push patches and trigger CI in victim projects.
Aikido Security researcher Joe Leon reported that GitLab “Email work item” addresses embed a long-lived glimt- token that does not expire. Possessing it lets someone create issues or merge requests as the owner, and an emailed Git patch can be applied with that user’s permissions, including edits to .gitlab-ci.yml that execute CI and may expose source, variables, or job tokens. GitLab says incoming email ignores IP restrictions and treated the behavior as designed, while clarifying documentation and token reset guidance. No CVE or observed attacks are stated; exploitation still requires the secret address and project routing details.
- Account-level glimt- email token does not expire
- Emailed Git patches can change .gitlab-ci.yml and run CI
- Incoming email bypasses project IP allowlists
- A Maintainer token may commit to protected branches
- GitLab documented secrecy and reset steps; feature remains
- Vendors
- GitLab
- Products
- GitLab
- Organizations
- Aikido SecurityGitLab
From the original article
2 min read at cybersecuritynews.com
GitLab’s “Email work item to this project” feature can become a repository-compromise primitive when its private address is exposed, according to research published by Aikido Security researcher Joe Leon on September 23, 2026. The address contains a long-lived glimt- incoming-email token that GitLab says does not expire and must remain secret. GitLab documentation confirms that […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.