GitLab Incoming-Email Tokens Can Enable Code Pushes to Private Projects

Aikido Security reported that GitLab's “Email work item to this project” addresses contain a long-lived, account-wide glimt- incoming-email token. An attacker who obtains one of these addresses can submit email as the token owner, create work items and merge requests, and send Git patches for application to repository branches—potentially affecting private projects under that user's permissions. The same token is reportedly embedded in addresses generated for multiple projects and is non-expiring.

A malicious patch modifying .gitlab-ci.yml could trigger attacker-controlled CI/CD jobs and expose source code or secrets; a leaked Maintainer token could also enable changes to protected branches. The inbound-email workflow reportedly bypasses project IP restrictions and does not validate sender addresses. GitLab has characterized the behavior as designed and updated interface wording and documentation, but has not changed the account-wide token model or added granular controls to disable the affected email features.