negativeSYS.SOURCE: The Hacker News• 2026-09-23T22:23:10+05:30

GitLab Email Token Vulnerability Allows Unauthorized Code Pushes and CI/CD Execution

#gitlab #vulnerability #security #ci-cd #email

A leaked GitLab email token allows attackers to push code and execute CI/CD jobs as the user by exploiting unverified email-based issue/merge request features. GitLab confirms the token persists indefinitely and does not restrict access based on email origin or user permissions.

The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you.

GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored

Read original article

*** END OF TRANSMISSION ***

> BESSEMER VENTURE PARTNERS RAISES $5.75B FOR AI-RELATED INVESTMENTS > INVESTIGATING UNVERIFIED SELLER ACTIVITY ON AMAZON > DOORDASH'S $1.4M CAMPAIGN AGAINST ZOHRAN MAMDANI REVEALED IN WAGE-THEFT SETTLEMENT > ENVEDA RAISES $311 MILLION FOR AI-DRIVEN NATURAL COMPOUND DRUG DEVELOPMENT > CLAUDE.AI PERFORMANCE OPTIMIZATION: 3X SPEED INCREASE IN TWO WEEKS > FORENSICDBG: A POST-MORTEM DEBUGGER FOR WINDOWS X64/X86 CRASH ANALYSIS > MODAL MOTORS AIMS TO ELIMINATE CHINA'S ROLE IN ELECTRIC MOTOR SUPPLY CHAINS > THE INEVITABILITY OF AI IN CLOUD COMPUTING ENVIRONMENTS > CLAUDE IDENTIFIES NOVEL ENZYME SYSTEM WITH CRISPR-LIKE REPEATS IN BACTERIOPHAGES > MALICIOUS TERRAFORM PROVIDERS EXPLOIT HASHICORP REGISTRY TO DISTRIBUTE GO-BASED MALWARE> BESSEMER VENTURE PARTNERS RAISES $5.75B FOR AI-RELATED INVESTMENTS > INVESTIGATING UNVERIFIED SELLER ACTIVITY ON AMAZON > DOORDASH'S $1.4M CAMPAIGN AGAINST ZOHRAN MAMDANI REVEALED IN WAGE-THEFT SETTLEMENT > ENVEDA RAISES $311 MILLION FOR AI-DRIVEN NATURAL COMPOUND DRUG DEVELOPMENT > CLAUDE.AI PERFORMANCE OPTIMIZATION: 3X SPEED INCREASE IN TWO WEEKS > FORENSICDBG: A POST-MORTEM DEBUGGER FOR WINDOWS X64/X86 CRASH ANALYSIS > MODAL MOTORS AIMS TO ELIMINATE CHINA'S ROLE IN ELECTRIC MOTOR SUPPLY CHAINS > THE INEVITABILITY OF AI IN CLOUD COMPUTING ENVIRONMENTS > CLAUDE IDENTIFIES NOVEL ENZYME SYSTEM WITH CRISPR-LIKE REPEATS IN BACTERIOPHAGES > MALICIOUS TERRAFORM PROVIDERS EXPLOIT HASHICORP REGISTRY TO DISTRIBUTE GO-BASED MALWARE