An Email Address Can Carry Repository Authority
Aikido demonstrated how an exposed token-bearing GitLab issue-by-email address permits attached patches, repository revisions and build execution. The research does not establish an active campaign.
The non-expiring credential spans the owner’s projects without checking senders. Email also bypassed IP restrictions. Attackers still need the target’s path plus ID and sufficient account permissions; branches are not universally writable.
GitLab warns that addresses are private and exposed tokens need resetting. Aikido reports better notices and guidance after disclosure, but unchanged underlying behaviour.
Recognise authority, not appearance
An address can resemble harmless contact information yet authenticate actions. Inventory its authority, not its appearance.
For maintainers, the question is what a compromised identity could change before a second person notices. Review repository write access, pipeline execution and production deployment separately. A successful commit should not automatically become permission to use every deployment secret.
Six checks for maintainers
- Search repositories, history, wikis, documentation, tickets and help centres for
@incoming.gitlab.comor the self-managed incoming-email domain. - Reset the owner’s leaked token using the vendor guidance; update dependent workflows.
- Audit the owner’s changes,
.gitlab-ci.yml, protected branches, plus unexpected jobs. - Use protected environments, scoped and short-lived CI secrets, separated runners and independent approval for production deployment.
- Review email ingestion alongside network controls: IP restrictions alone do not cover this route.
- Replace published token-bearing addresses with an ordinary support mailbox or issue form.
BlackTree previously covered an unauthenticated flaw that could make public projects writable and an AI-agent path into CI commands (CVE-2026-18252). This route uses an exposed credential, without needing a software exploit.
Sources and chronology
- Aikido: 23 September 2026; updated 29 September. Times unspecified.
- BleepingComputer reporting: 24 September 2026, 13:47 displayed; timezone unspecified.
- GitLab documentation: checked 27 October 2026; no article publication time provided.
