Leaked GitLab email tokens can open private code pipelines
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, September 24th, 2026.
A leaked GitLab project email address can let an outsider act with the token owner’s permissions. These addresses contain non-expiring incoming-mail tokens, and research found that the same account-level token may work across a user’s public and private projects. Someone who obtains an address could submit merge requests, push code where the user has permission, or trigger continuous integration jobs. The research also found that actions sent by email could bypass project I P restrictions.
GitLab described the underlying behavior as intended, although it changed its interface and documentation to make the capabilities and I P restriction exception clearer. The practical risk is that an address presented as a workflow convenience can function like a software supply-chain credential. The damage depends on the owner’s role, branch protections, and pipeline permissions. Leaders should ensure secret-management programs cover unusual credentials embedded in automation features. Defenders should search repositories, documentation, tickets, and public pages for incoming-mail tokens and review affected pipelines and commits. Scan for exposed GitLab incoming-mail addresses, rotate their tokens, and review activity performed under affected identities.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
