Exposed GitLab project email tokens let attackers open merge requests

Leaked project email addresses can be abused to act as a maintainer, creating issues and merge requests that bypass IP restrictions.

Security firm Aikido found that many GitLab projects are publicly posting their private “Email work item to this project” addresses, exposing long‑lived tokens that GitLab treats as project credentials. These addresses can be used by any mail sender to create issues, and—by swapping the “-issue” suffix for “-merge-request”—to open merge requests as if they were the token owner, potentially enabling pushes to protected branches, CI/CD execution, and access to private code and secrets depending on the account’s permissions. The email-based workflow also ignores IP allowlists, so this path can bypass IP restrictions configured on GitLab accounts or projects. Aikido quickly found about a dozen live addresses in public READMEs and contributor docs, including for popular open-source projects, creating supply‑chain risk for downstream users. GitLab had previously documented these addresses as private and warned that anyone who knows one can act as the owner, and after Aikido’s reports it updated its UI and docs while maintainers are being urged to remove such addresses from public docs and rotate the associated tokens.