A Critical Flaw Exposes GitLab Projects to Code Injection Attacks
GitLab users are being put at risk by a critical security flaw that allows attackers to push code to protected branches of private repositories. Researchers at Aikido have discovered that private email addresses used for creating work items via email can be exposed in public documentation, leaving them vulnerable to exploitation.
These email addresses contain a long-lived token tied to the developer’s account, which serves as a credential for accessing the project. When an external client sends a message to one of these addresses, GitLab parses it into a project issue or task. An attacker could use this vulnerability to compromise GitLab accounts and gain unauthorized access to sensitive data.
Aikido researchers found multiple private GitLab addresses exposed in public READMEs, contributing guides, and support pages used to collect bug reports. In some cases, these addresses were deliberately included in public documentation by project maintainers, who may not have realized the security implications of doing so. The exposure affected popular open-source projects, creating supply-chain risks for large user bases.
The vulnerability allows attackers to bypass IP address restrictions and push code changes, CI/CD runs, access private repositories, secrets, and more. While permission restriction can prevent unauthorized actions, an attacker still needs the target project’s path and ID. In public projects, this information is publicly available, while in private projects, it can be brute-forced or leaked.
GitLab has acknowledged the issue and taken steps to address it. The company has updated its UI to mention merge requests, removed false statements about token data access, and documented that incoming email bypasses IP restrictions. However, project maintainers are still at risk if they have exposed these addresses in public documentation.
To mitigate this vulnerability, project maintainers should stop voluntarily exposing private email addresses in public documentation and reset tokens for projects they exposed this way in the past. This will help prevent attackers from exploiting the flaw and ensure that sensitive data remains secure.
In a broader context, this vulnerability highlights the importance of security awareness among developers and project maintainers. It’s essential to be aware of potential vulnerabilities and take proactive steps to address them before it’s too late. By being vigilant and following best practices for security, we can prevent such attacks from happening in the first place.
Source: Bleeping Computer — 2026-09-24