NewsPublished 24 Sep 2026

Exposed GitLab project email addresses let attackers push code

Source Bleeping Computer

Description

Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. [...]

Impact

Attackers who obtain exposed GitLab private email addresses can create issues or merge requests on projects as if they were the token owner. This can lead to unauthorized code changes, access to private repositories, exposure of secrets from CI/CD variables, and access to confidential issues. The level of impact depends on the permissions of the associated GitLab account. The attack bypasses IP restrictions and can affect both public and private projects if project identifiers are known or leaked. This creates supply-chain risks, especially for popular open-source projects that expose these addresses in public documentation.

Defensive guidance

GitLab advises users to keep private email addresses containing tokens confidential and to reset the token immediately if exposure is suspected. Project maintainers should remove these email addresses from public documentation such as READMEs and contributing guides. Tokens for any exposed projects should be reset to prevent unauthorized use. GitLab has updated its UI and documentation to clarify the risks but considers this behavior intended.

References

bleepingcomputer.com/news/security/exposed-gitlab-project-email-addresses-let-attackers-push-code/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Sep 2026, 17:48 UTC

References

Community reviews