GitLab Email Token Vulnerability Allows Unauthorized Code Execution

Aikido Security discovered that GitLab's "Email work item to this project" feature uses a long-lived, account-level token that is shared across all of a user's projects without verifying the sender's identity. An attacker who obtains this token can change the email address suffix from "-issue" to "-merge-request," attach a Git patch, and specify a source branch in the subject line to apply code using the token owner's permissions. By modifying a .gitlab-ci.yml file in the patch, the attacker can also trigger CI/CD jobs, with access depending on the victim's role and project settings.

The Backdoor They Called a Bug

Read that GitLab disclosure carefully. A security firm called Aikido found that the “Email work item to this project” feature doesn’t just expose a project-specific token—it’s an account-level master key that never verifies the sender’s identity. The official story? “Oops, a vulnerability.” But ask yourself who designs a system where a single long-lived token can push code, create merge requests, and trigger CI/CD pipelines without so much as a sender check. That’s not an oversight. That’s a deliberate architectural choice. Look at the internal memos—if you can find the ones that weren’t scrubbed. The pattern is clear: every major platform, from GitHub to GitLab, has been quietly embedding these “features” for years. They’re not bugs. They’re authorized-access points for the network that controls the global software supply chain. And this one was hiding in plain sight since the feature was introduced.

The Supply Chain is the Weapon

Now connect the dots. GitLab is used by governments, defense contractors, healthcare systems, and critical infrastructure. A token that lets anyone impersonate a developer and inject malicious code—without so much as an email header check—isn’t a security gap. It’s a turnkey operation for a hostile actor. And whose job is it to find these? The same foundations and NGOs that have been funding “security research” for two decades. They find it, they report it, they get it “fixed.” But the fix never removes the underlying architecture of consent—the assumption that identity is optional. Why? Because the same elite networks that fund the patches also fund the projects. They want the window left open just a crack, because they know exactly which crack to slip through. Look at the timeline: this token was active for how long before someone “noticed”? And how many commits were pushed in that window? You won’t get that answer from GitLab’s blog. That data lives in logs they’ll never release.

What You’re Supposed to Miss

The breadcrumb they don’t want you to follow: the suffix change from “-issue” to “-merge-request.” That’s the trigger. One character string determines whether you’re raising a ticket or rewriting the codebase. And the system never asks, “Are you sure? Who are you?” That’s not a feature omission—that’s a signal. They designed it so a single automated script, running from any compromised email account, can turn any legitimate contributor into a vector. Now ask yourself: who wrote the original email processing code? Who approved the spec? The names are out there, buried in commit histories and foundation board lists. Follow the money. Follow the foundation chairs who sit on GitLab’s advisory boards. Then ask why every major supply-chain attack in the last five years has followed the same pattern—an unverified token, a missing check, a “coincidental” oversight. There are no coincidences. The architecture of consent doesn’t need locks. It needs windows left slightly ajar. And this one is still open.