Aikido Says GitLab Email Tokens Let Attackers Alter Repositories Across 5 Projects
Updated
Updated · InfoWorld · Sep 25
Aikido Says GitLab Email Tokens Let Attackers Alter Repositories Across 5 Projects
3 articles · Updated · InfoWorld · Sep 25
Summary
GitLab’s project issue email feature can let anyone holding a leaked address modify repositories and trigger CI/CD jobs with the linked user’s permissions, Aikido Security said.
Aikido traced the risk to a long-lived “glimt-” token embedded in the address; across five projects on one account, it found the same token reused account-wide rather than per project.
The firm said the email route bypasses GitLab IP restrictions and can be abused not just to create issues but, by changing the suffix, to open merge requests that land attacker-controlled code in pipelines.
GitLab considers the behavior intended rather than a vulnerability, though it updated the UI to say the token can create issues and merge requests after Aikido’s report.
Aikido said leaked addresses are easy to find—it found about a dozen in hours—and urged organizations to treat them as credentials, hunt for exposures and reset tokens if compromised.