> TritonInfoSec News
Home / Sep 25, 2026 / Story
0
#8 The Hacker News general September 23, 2026 at 16:53 UTC

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

By [email protected] (The Hacker News)

AI Summary

GitLab's per-project incoming email addresses, which allow users to file issues via email, function as privileged credentials: anyone who obtains the address can commit code in the victim's name to any branch they have push access to, including main, and trigger CI/CD pipeline jobs running as that user. The addresses are accessible through the GitLab UI behind an 'Email work item to this project' button and are not rotated by default. This represents a serious supply chain and account takeover risk for any organization using GitLab's email integration feature.

Read full article → https://thehackernews.com/2026/09/a-leaked-gitlab-…

Relevance score: 79.0/100

# More from September 25

  1. 1
    There's a new way to break RSA that's faster than anything we've seen before Ars Technica Security
  2. 2
    Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure The Hacker News
  3. 3
    OpenAI hacked Australian Medicare govt site, probed data providers BleepingComputer
  4. 4
    CISA: Ransomware gangs now exploiting critical TeamCity flaw BleepingComputer
  5. 5
    Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges The Record
  6. 6
    Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content The Hacker News
  7. 7
    Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry The Hacker News
  8. 9
    Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer The Hacker News
  9. 10
    Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks The Record