Exposed GitLab project email addresses let attackers push code
BLUF
Publicly leaked GitLab email addresses enable unauthorized code pushes and issue creation, compromising project integrity.
NEWS
Security researchers identified that private GitLab email addresses, intended for internal workflows, are being published in public documentation like READMEs. This exposure allows threat actors to bypass authentication and push malicious code or create fake issues directly to repositories. The vulnerability impacts organizations using GitLab's email-to-commit features without securing associated addresses.
Why I Care
This poses a severe supply chain risk, allowing attackers to introduce backdoors or malware into software before release. DevOps teams and open-source maintainers are directly affected, as compromised repositories can lead to downstream infections for end-users and significant reputational damage.
Next Steps
Security teams must scan all public-facing documentation for exposed GitLab email patterns and disable email-based push features if not strictly required. Project maintainers should rotate exposed addresses and enforce stricter access controls on repository write permissions immediately.
Source: BleepingComputer ·