GitLab issue email’s only security is obscurity
GitLab issue-creation emails embed an account-wide token that can open merge requests and run CI/CD.
Aikido Security found that GitLab’s “email a work item” feature embeds a long-lived personal access token, prefixed glimt-, in an address enabled for every GitLab.com account and impossible to disable. The same token covers every project the account can reach; changing its suffix can open merge requests and run attacker-controlled CI/CD, and email actions ignore IP restrictions that block browser and git access. GitLab calls the behavior intended and updated its warning to mention merge requests as well as issues. Aikido says roughly a dozen addresses were already exposed online, including one for wget2, and advises treating them as credentials and resetting the token.
- GitLab.com enables incoming issue-email addresses for every account and they cannot be disabled.
- Each address embeds one account-wide glimt personal access token.
- The token can create issues and merge requests and trigger CI/CD within the user's permissions.
- Email actions bypass IP allowlists that block browser and git access.
- Aikido found about a dozen exposed addresses, including the wget2 project.
- Vendors
- GitLab
- Products
- GitLab
- Organizations
- Aikido Security
From the original article
3 min read at csoonline.com
It was meant to make life simpler: a secret email address to which developers can send a message and create an issue in their GitLab project. But poor security defaults and a long-lived token embedded in the address mean that anyone who knows the address can potentially modify protected repositories. If project owners publish or leak these addresses, as some have, then they become vulnerable.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.