Exposed GitLab project email addresses let attackers push code
Aikido warns published GitLab incoming-email tokens can let outsiders open merge requests and push code as the owner.
4
Stories per day · 30 days
3 stories, newest first · one card per story
Stories tagged #incoming-email
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
A leaked GitLab incoming-email token lets outsiders commit code and run CI jobs as the account owner.
1
GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories
Aikido says a leaked GitLab incoming-email token can push patches and trigger CI in victim projects.
1