Executive Summary
In September 2026, Aikido Security disclosed a critical vulnerability in GitLab's email-based issue creation feature that allows attackers to impersonate users and execute unauthorized code commits. The flaw stems from GitLab's private email addresses for filing issues, which contain non-expiring tokens that can be exploited by anyone who obtains them. Attackers can use these leaked addresses to commit code patches to any branch the user has access to, including main branches, and trigger CI/CD jobs that execute with the victim's permissions. The attack bypasses IP restrictions and two-factor authentication, potentially compromising entire development pipelines and supply chains.
This incident highlights the growing sophistication of supply chain attacks targeting developer infrastructure and CI/CD environments. As organizations increasingly rely on automated development workflows and DevOps practices, vulnerabilities in platforms like GitLab pose significant risks to software integrity and organizational security posture.
Why This Matters Now
This vulnerability exposes critical gaps in DevOps security at a time when supply chain attacks are rapidly increasing. The ability to bypass authentication controls and inject malicious code directly into main branches threatens software integrity across organizations relying on GitLab for development workflows.
Attack Path Analysis
Attacker obtains leaked GitLab issue email token from public repositories or documentation, uses merge request by email feature to commit malicious code directly to main branch bypassing IP restrictions and 2FA, leverages CI/CD pipeline modifications to execute code with target user permissions, establishes persistence through automated job execution, exfiltrates sensitive data or secrets accessible to compromised account, and achieves supply chain compromise by injecting malicious code into production deployments.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker discovers leaked GitLab issue email address containing universal token in public repositories, documentation, or README files, gaining ability to act with target user's permissions without authentication
MITRE ATT&CK® Techniques
Valid Accounts
Trusted Developer Utilities Proxy Execution
Command and Scripting Interpreter: Cloud API
Phishing: Spearphishing via Service
Modify Authentication Process
Supply Chain Compromise: Compromise Software Supply Chain
Scheduled Task/Job: Container Orchestration Job
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Authentication Credential Management
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Identity Verification and Authentication
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21.2(a)
ISO 27001:2022 – User Registration and De-registration
Control ID: A.9.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
GitLab's leaked email tokens enable supply chain attacks through unauthorized code commits and CI/CD pipeline manipulation, bypassing authentication controls.
Financial Services
Banking systems using GitLab face regulatory compliance violations as attackers can bypass IP restrictions and 2FA to access protected repositories.
Health Care / Life Sciences
Healthcare organizations risk HIPAA violations through unauthorized access to protected health information repositories via leaked GitLab email addresses.
Government Administration
Government agencies face critical infrastructure risks as leaked tokens allow unauthorized code deployment to main branches without proper verification.
Sources
- A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as Youhttps://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.htmlVerified
- GitLab Email Push to Main - Security Research by Aikido Securityhttps://www.aikido.dev/blog/gitlab-email-push-to-mainVerified
- GitLab Documentation - Creating Merge Requests by Emailhttps://docs.gitlab.com/user/project/merge_requests/creating_merge_requests/#by-sending-an-emailVerified
- GitLab Security Tokens Documentationhttps://docs.gitlab.com/security/tokens/#incoming-email-tokenVerified
- GitLab Issue Tracking - Email Security Considerationhttps://gitlab.com/gitlab-org/gitlab/-/work_items/617883Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this GitLab token compromise by constraining lateral movement across cloud environments and limiting outbound data exfiltration paths through segmented network controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial token compromise would likely still occur, but CNSF visibility could reduce the scope of accessible cloud resources by providing detailed monitoring of cross-environment authentication patterns and suspicious access attempts.
Control: Zero Trust Segmentation
Mitigation: Zero trust principles would likely constrain the attacker's ability to access production deployment environments even with elevated repository permissions, reducing the scope of systems reachable through compromised CI/CD pipelines.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely reduce the attacker's ability to move between different cloud environments and projects, constraining cross-repository access and limiting the scope of compromised CI/CD infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility would likely detect and constrain unauthorized CI/CD job execution patterns across different cloud environments, reducing the attacker's ability to establish persistent command channels through pipeline infrastructure.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely constrain the attacker's ability to exfiltrate data through CI/CD pipelines by limiting outbound network paths and enforcing data loss prevention policies on automated job traffic.
While malicious code injection could still occur, the constrained network reachability and segmented deployment environments would likely reduce the scope of affected production systems and limit the attacker's ability to establish widespread backdoors.
Impact at a Glance
Affected Business Functions
- Software Development and CI/CD Pipelines
- Source Code Management
- DevOps Operations
- Software Supply Chain Security
Estimated downtime: N/A
Estimated loss: N/A
Potential unauthorized access to private repositories, source code, CI/CD secrets, and development infrastructure through GitLab's email-to-issue token feature. Risk of malicious code injection into main branches and execution of unauthorized CI/CD jobs with developer privileges.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to isolate CI/CD environments and limit blast radius of compromised developer credentials
- • Deploy egress security controls with FQDN filtering to detect and block unauthorized data exfiltration from CI/CD pipelines
- • Enable multicloud visibility and anomaly detection to identify suspicious automation patterns and repeated malformed requests to development infrastructure
- • Establish threat detection capabilities to baseline normal CI/CD behavior and alert on covert tools or unauthorized pipeline modifications
- • Enforce encrypted traffic inspection for all development workflows to prevent credential harvesting and unauthorized code commits
