A Leaked Git Lab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

Summary: GitLab's per-user email address for filing issues contains a non-expiring token that, per Aikido Security's report, is shared across all of a user's projects and is not checked against the sender, so anyone holding the address can open issues, commit patches to any branch the user can push to, and start CI/CD jobs as that user. Aikido demonstrated the bypass by locking a private project to a single IP address and finding GitLab refused its browser and git clone but accepted a merge request email, landing the commit on main, and noted incoming email is exempt from IP restrictions and works without 2FA.
What's compelling: A leaked address for a Maintainer reaches protected branches and CI/CD secrets, and the token never expires, so the exposure persists until the address is rotated. GitLab closed Aikido's May 2026 HackerOne report as intended behavior and has only opened an issue to consider sender verification, meaning no per-user switch exists today.

Read the original at The Hacker News ↗