Executive Summary
In September 2026, security researchers at Aikido discovered that private GitLab email addresses containing long-lived authentication tokens were being deliberately exposed in public documentation by project maintainers. These addresses, part of GitLab's "Email work item to this project" feature, allow attackers to push code to protected branches, access private repositories, steal CI/CD secrets, and compromise developer accounts without proper authentication validation. The vulnerability affects popular open-source projects, creating significant supply chain risks as attackers can modify email suffixes to escalate from creating issues to opening merge requests.
This incident highlights the growing trend of misunderstood security features in DevOps platforms leading to supply chain compromises, as organizations increasingly rely on automated development workflows without fully comprehending the associated security implications.
Why This Matters Now
Supply chain attacks targeting developer platforms have increased 650% in 2026, with attackers specifically exploiting misconfigurations in CI/CD pipelines and version control systems to inject malicious code into trusted software repositories.
Attack Path Analysis
Attackers exploited exposed GitLab email addresses containing long-lived tokens found in public documentation to gain initial access. They escalated privileges by manipulating email suffixes to create merge requests instead of issues, bypassing authentication controls. Lateral movement occurred through accessing private repositories and CI/CD variables across projects. Command and control was established via automated email-based interactions with GitLab APIs. Sensitive source code, secrets, and proprietary information were exfiltrated through repository access. Supply chain impact resulted from compromised popular open-source projects affecting downstream users.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers discovered exposed GitLab project email addresses containing 'glimt-' tokens in public READMEs and documentation, providing unauthorized access to project functionality
MITRE ATT&CK® Techniques
Valid Accounts: Local Accounts
Phishing: Spearphishing Attachment
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Trusted Relationship
Data from Information Repositories: Code Repositories
Unsecured Credentials: Credentials In Files
User Execution: Malicious File
Build Image on Host
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong User Authentication and Access Management
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
CISA ZTMM 2.0 – Software platforms and applications within the organization are inventoried
Control ID: ID.AM-2
DORA – Third-party risk management
Control ID: ICT-RM-05
NIS2 Directive – Cybersecurity risk management measures
Control ID: Article 21(2)(a)
ISO 27001 – Management of privileged access rights
Control ID: A.9.2.3
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
GitLab supply-chain vulnerabilities enable code injection into private repositories, compromising CI/CD pipelines and exposing proprietary source code to unauthorized access.
Financial Services
Exposed GitLab tokens allow attackers to access sensitive financial systems code, violate PCI compliance requirements, and compromise trading algorithms through merge requests.
Health Care / Life Sciences
GitLab email token exposure threatens HIPAA compliance through unauthorized access to healthcare application repositories containing patient data processing code and medical secrets.
Defense/Space
Supply-chain attacks via GitLab tokens could compromise critical defense software repositories, enabling adversaries to inject malicious code into military systems.
Sources
- Exposed GitLab project email addresses let attackers push codehttps://www.bleepingcomputer.com/news/security/exposed-gitlab-project-email-addresses-let-attackers-push-code/Verified
- GitLab Email Push to Main - Security Researchhttps://www.aikido.dev/blog/gitlab-email-push-to-mainVerified
- GitLab Documentation - Create Issues via Emailhttps://docs.gitlab.com/user/project/issues/create_issues/Verified
- GitLab Work Item - Email Security Considerationhttps://gitlab.com/gitlab-org/gitlab/-/work_items/617883Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have constrained this GitLab token abuse incident by limiting exposed service access points and reducing lateral movement across repository boundaries. Zero Trust segmentation would likely have contained the blast radius from token misuse to specific project scopes.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Service exposure policies would likely have restricted access to GitLab email endpoints and could have limited the reachability of token-based authentication mechanisms from external sources.
Control: Zero Trust Segmentation
Mitigation: Identity-aware access controls would likely have limited privilege scope by restricting token capabilities to specific functions and could have reduced the ability to escalate permissions through email manipulation.
Control: East-West Traffic Security
Mitigation: Microsegmentation policies would likely have constrained cross-repository access and could have limited the scope of CI/CD pipeline traversal across different project boundaries within the GitLab environment.
Control: Multicloud Visibility & Control
Mitigation: API traffic monitoring and control policies would likely have detected anomalous email-based GitLab interactions and could have constrained persistent access patterns through behavioral analysis.
Control: Egress Security & Policy Enforcement
Mitigation: Data loss prevention policies would likely have constrained bulk repository access and could have limited the scope of CI/CD secret extraction through controlled egress monitoring.
While malicious code injection would likely still pose supply chain risks to downstream consumers, the scope of affected repositories and compromised secrets would be significantly reduced through earlier containment.
Impact at a Glance
Affected Business Functions
- Software Development and Version Control
- Source Code Management
- CI/CD Pipeline Operations
- Open Source Project Maintenance
Estimated downtime: N/A
Estimated loss: N/A
Private source code repositories, CI/CD secrets and variables, confidential project issues, and merge request capabilities. Attackers could potentially access proprietary code, steal intellectual property, inject malicious code into protected branches, and compromise software supply chains of affected open source projects.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access controls and prevent token-based lateral movement across GitLab projects and repositories
- • Deploy Egress Security & Policy Enforcement to monitor and control outbound data flows from development environments and detect unauthorized repository access patterns
- • Enable Multicloud Visibility & Control to gain centralized observability into GitLab API interactions and identify anomalous automation patterns across development workflows
- • Establish Threat Detection & Anomaly Response capabilities to baseline normal GitLab usage patterns and alert on suspicious email-based API interactions or unusual merge request activities
- • Apply Cloud Native Security Fabric (CNSF) controls to provide real-time inspection and policy enforcement for development tool integrations and supply chain security risks
