Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines

Security researchers have uncovered a potential vulnerability in GitLab that could allow attackers to use a leaked project email address to push code, trigger CI/CD jobs, and access other repositories accessible to the owner of the email address. The issue revolves around GitLab's incoming email token, a credential embedded in private email addresses for creating issues and merge requests via email.

This token essentially acts as a fine-grained personal access token with significant access to the user's GitLab projects. According to the report, anyone who obtains this token can create issues and merge requests as the user, and GitLab documentation warns that anyone with this token can do so. Additionally, GitLab allows users to attach .patch files when creating merge requests by email, and the token also enables CI/CD execution and exfiltration of private source code.

An attacker who obtains one of these addresses could change its suffix, attach a patch, and submit code using the victim's existing GitLab permissions. This vulnerability is constrained by the victim's existing GitLab permissions and the attacker's knowledge of the target project. The incoming email token does not elevate privileges.

The researchers reported the behavior through HackerOne in May, and GitLab updated its interface and documentation after initially closing the report as intended behavior. A GitLab merge request was opened on July 28 to clarify the token's capabilities and emphasize its private nature. Users can reset the token from GitLab's personal access token settings if they believe one of these addresses has been exposed.