Gitlab’s Private Email Addresses Expose Users to Supply Chain Attacks
A new research report from Aikido Security has uncovered a critical vulnerability in GitLab’s DevOps platform, allowing attackers to exploit private email addresses and gain access to an organization’s entire project portfolio. The issue stems from the way GitLab automatically assigns unique email addresses to each user, which contain highly privileged access tokens that can be used for malicious purposes.
The problem lies in the fact that these email addresses are not just limited to creating issues within a specific project, but also grant broad access to public and private projects across an organization. If an attacker gains access to one of these email addresses, they can use it to push code to main branches, execute continuous integration/continuous deployment (CI/CD) jobs, and even bypass IP address restrictions.
Aikido’s research team found that many GitLab users are unaware of the risks associated with these email addresses. The issue is exacerbated by the fact that these addresses often contain a non-expiring token string, known as a glimt- prefix string, which can be reused across all public and private projects to which a user has access.
According to Joe Leon, an Aikido researcher who conducted the investigation, GitLab’s user interface (UI) does not clearly communicate the risks associated with these email addresses. While the UI states that these addresses cannot be used to access any other data, this is demonstrably false. The credential embedded in each email address can be reused across all public and private projects.
Leon’s research also found that an attacker could modify the project path slug and project ID in the email to reach other private projects, even if they only have access to a public project. This makes it possible for attackers to push code to main branches or execute CI/CD jobs without needing actual access to the account.
The implications of this vulnerability are significant, as exposed GitLab email addresses can be used for supply chain attacks. In fact, Leon conducted a simple search on the Internet and found over a dozen incoming email addresses that had been intentionally exposed.
This discovery highlights the importance of securing private email addresses and ensuring that users are aware of the risks associated with these access tokens. As Leon notes, “It wasn’t communicated clearly that there’s something sensitive in there that not only can create issues but push code.” GitLab users must take steps to protect their organization’s project portfolio by securing these email addresses and limiting access to sensitive projects.
In practical terms, this means that organizations using GitLab should review their security settings and ensure that IP address restrictions are in place for private projects. Additionally, users should be aware of the risks associated with exposing private email addresses and take steps to secure them, such as changing passwords or revoking access tokens. By taking these precautions, organizations can mitigate the risk of supply chain attacks and protect their project portfolio from unauthorized access.
Source: Dark Reading — 2026-09-23