Publicly exposed GitLab project email addresses can let attackers act as a developer and submit project content that GitLab treats as trusted. The issue involves GitLab's built-in "Email work item to this project" feature, where long-lived email addresses contain a token string beginning with "glimt-"; changing an exposed -issue address to -merge-request can create a merge request, and GitLab processes messages from any sender as the token owner. Researchers say this can bypass IP restrictions and, depending on permissions, expose private repositories, confidential issues, and CI/CD secrets.
Why it matters: Projects that pasted these private GitLab addresses into public READMEs or support pages may have handed attackers a path to tamper with code or access internal project data. Maintainers should remove exposed addresses, reset the associated incoming-email tokens immediately, and review whether protected branches, private issues, or CI/CD variables were exposed.
Bill Toulas
2026.09.24
100% relevant
This article establishes a distinct GitLab security story centered on exposed incoming-email tokens being abused to create merge requests and potentially affect private repositories and software supply chains.
← Back to all stories