Exposed GitLab Project Emails Could Let Attackers Submit Code

Developers who publish a private GitLab project email address to collect bug reports may also give attackers a way to create work items in their name. Researchers at Aikido found live addresses in public project documentation and warned that the same credentials could enable merge requests.

Private Addresses Contain Long-Lived Tokens

GitLab lets users create project issues or tasks by sending an email to a specially generated address. The address contains a glimt- token tied to the user’s account. GitLab uses that token to process incoming messages as work from the account owner.

These addresses are meant to remain private. However, Aikido found them in public READMEs, contribution guides and support pages. Some project maintainers had published the addresses so people could email bug reports.

Attackers Can Change the Address to Create Merge Requests

According to Aikido, someone who obtains an address can change its -issue suffix to -merge-request. GitLab will then accept email sent to the modified address as a merge request from the token owner.

The sender does not need to use the owner’s email account. Aikido’s tests also found that incoming email bypassed GitLab IP address restrictions.

The access an attacker gains depends on the token owner’s permissions. In some circumstances, the resulting activity could affect private repositories, code changes or CI/CD processes. An attacker would also need the target project’s path and ID; knowing the email address alone does not remove those requirements.

Researchers Found Addresses in Public Documentation

Aikido found about a dozen live incoming addresses during one afternoon of searching. Some belonged to popular open-source projects.

The researchers reported the issue to GitLab in May 2026. GitLab closed the report as intended behavior. After a follow-up in June, GitLab updated its interface and documentation to explain the merge request capability and the effect on IP restrictions.

GitLab’s documentation warns users to keep these addresses private. It says anyone who knows one can create issues or merge requests as its owner.

Maintainers Should Reset Exposed Tokens

Project maintainers should remove any published GitLab project email address from public documentation. If an address has already appeared publicly, they should reset its token and review the project for unexpected work items or merge requests.