aiqbench analysis
This vulnerability exposes how GitLab's incoming email feature can bypass network controls and CI/CD protections, allowing attackers to inject malicious code into private repositories under victim identities. The core issue lies in the reuse of long-lived account-level tokens across different projects, which undermines assumptions about IP allowlists and branch protection rules. For developers relying on automated pipelines, this highlights a critical gap where email-based workflows can become a vector for supply chain attacks without additional authentication layers.
GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories
GitLab’s “Email work item to this project” feature can become a repository-compromise primitive when its private address is exposed, according to research published by Aikido Security researcher Joe Leon on September 23, 2026. The address contains a long-lived glimt- incoming-email token that GitLab says does not expire and must remain secret. GitLab documentation confirms that […] The post GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories appeared first on Cyber Security News.
GitLab’s “Email work item to this project” feature can become a repository-compromise primitive when its private address is exposed, according to research published by Aikido Security researcher Joe Leon on September 23, 2026. The address contains a long-lived glimt- incoming-email token that GitLab says does not expire and must remain secret.…
Excerpt shown under the publisher's RSS terms · 51 words · full text and figures are on the publisher's site
