A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

A GitLab vulnerability is allowing unauthorized code commits and CI/CD job execution by exploiting a leaked email address. The issue stems from a token associated with user accounts, which can be used to create issues and merge requests, effectively impersonating the user and pushing code to any branch, including the main branch, and running CI/CD jobs. GitLab’s documentation states that incoming email is not subject to IP restrictions, and the token does not expire.

Aikido Security discovered that the token can be used to commit code, using GitLab's merge request by email feature. To achieve this, a user simply changes the address suffix from -issue to -merge-request, writes a patch, and attaches it to the email, specifying a target branch. GitLab then applies the patch to that branch, creating a commit authored by the user, even if it's a branch they can push to. The vulnerability is exacerbated by the fact that the token carries only the user's permissions, meaning a Guest account has limited impact, while a Maintainer account can access protected branches and CI/CD secrets.

GitLab has addressed the wording around the token, clarifying that it can create issues and merge requests, but the core functionality remains unchanged. The token does not expire, and GitLab doesn't verify the sender of the email. A private project requires a separate leak of the project's path and ID, which are easily guessable. GitLab Dedicated is not affected due to its limited scope.

GitLab initially closed the issue as intended behavior through HackerOne in May 2026, but Aikido Security followed up with a confidential issue in June. GitLab’s current stance is that the token is a standard credential, and any leaked credential leads to negative outcomes. The Hacker News has reached out to GitLab and Aikido for comment.