An investigation by Aikido Security’s researcher Joe Leon, published on September 23, 2026, reveals a significant vulnerability in GitLab’s ‘Email work item to this project’ feature. This flaw could potentially allow unauthorized code injection into private repositories if the assigned private address is exposed.
Understanding the Vulnerability
The crux of the issue lies in the glimt-incoming-email token associated with the feature, which GitLab confirms as non-expiring and confidential. Possession of this token enables the creation of issues and merge requests under the token owner’s name, posing a severe threat to repository security.
Aikido Security found that while the interface provides a project-specific email address, these addresses share an account-level token across different projects. This commonality allows attackers to manipulate the address suffix to exploit the system further.
Exploitation Techniques
Attackers can modify the ‘-issue’ suffix to ‘-merge-request’, attach a malicious Git patch, and specify a source branch in the email subject. Consequently, GitLab may apply this patch using the compromised user’s permissions. Such actions can alter the .gitlab-ci.yml file, enabling attacker-controlled CI/CD executions within the victim’s project.
The severity of this exploitation varies with the user’s role and pipeline settings, potentially exposing sensitive data like source code, CI/CD variables, or job tokens. In some scenarios, maintainers’ leaked addresses could permit unauthorized commits to protected branches under the victim’s identity.
Network Security Challenges
Aikido Security’s research also challenges assumptions about network controls. They demonstrated that GitLab accepts emailed patches even when other access methods are blocked by IP restrictions, indicating that incoming emails bypass such security measures.
Successful exploitation requires not only the private address but also sufficient information to target the project, such as its path and ID. While public repositories reveal these details, private projects generally require additional leaks to be vulnerable.
Preventive Measures and GitLab’s Response
GitLab has acknowledged the behavior as intentional rather than a bug, subsequently updating documentation to clarify token capabilities and emphasize the importance of maintaining secrecy. Although the email mechanism persists, the updated text highlights the necessary precautions.
Security teams are urged to examine repositories, logs, and other resources for exposure of glimt- addresses or outdated tokens. If exposure is suspected, resetting the incoming email token and reviewing user permissions and project security settings are critical steps.
Organizations must treat project email addresses with the same caution as account credentials to prevent unauthorized access and maintain repository integrity.
