Security Flaw in GitLab’s Auto-Generated Email Addresses Exposes Privileged Tokens

Security researchers have highlighted a vulnerability in GitLab’s inbound email system that could allow attackers to hijack privileged accounts. The platform automatically creates a unique email address for each user, embedding an access token that grants the same rights as the associated user account. If an adversary obtains that address, they can use the token to perform actions on behalf of the user, opening a pathway for supply‑chain attacks.

GitLab’s inbound email feature is designed to let developers create issues, comments, or merge requests by sending an email to a user‑specific address. The address typically follows a pattern that includes the username and a long alphanumeric string – the token – which the service validates to authenticate the incoming request. This convenience, however, means the token is visible in plain text within the email address itself.

The problem arises when the token is exposed outside the intended context. Because the token functions as an API key, anyone who discovers the full address can invoke GitLab’s API with the same permissions as the legitimate user. In practice, an attacker who captures the address – for example, through email forwarding, log leakage, or phishing – could create malicious merge requests, alter pipeline configurations, or exfiltrate source code, all without needing additional credentials.

Supply‑chain attacks increasingly target the tools that developers rely on to build and deliver software. Compromising a CI/CD platform like GitLab can give threat actors the ability to inject malicious code into many downstream projects. The discovery of this email‑token exposure therefore adds a new vector to the already complex threat landscape surrounding software supply chains.

GitLab responded to the findings by issuing an advisory that recommends users rotate any tokens that may have been exposed and consider disabling the inbound email feature where it is not essential. The company also indicated that a patch will be released to either obfuscate the token in the address or replace it with a more secure mechanism for email‑based interactions.

For organizations that rely on GitLab, the incident underscores the importance of reviewing how authentication secrets are embedded in URLs, scripts, or email addresses. Security teams are urged to audit existing inbound email configurations, enforce least‑privilege principles, and monitor for unexpected API activity linked to token usage. The broader lesson is a reminder that convenience features must be balanced against the risk of inadvertently leaking credentials in plain sight.