GitLab Email Token Vulnerability Allows Unauthorized Code Execution

Aikido Security discovered that GitLab's "Email work item to this project" feature uses a long-lived, account-level token that is shared across all of a user's projects without verifying the sender's identity. An attacker who obtains this token can change the email address suffix from "-issue" to "-merge-request," attach a Git patch, and specify a source branch in the subject line to apply code using the token owner's permissions. By modifying a .gitlab-ci.yml file in the patch, the attacker can also trigger CI/CD jobs, with access depending on the victim's role and project settings.

The Backdoor They Called a Bug

Read that GitLab disclosure carefully. A security firm called Aikido found that the “Email work item to this project” feature doesn’t just expose a project-specific token—it’s an account-level master key that never verifies the sender’s identity. The official story? “Oops, a vulnerability.” But ask yourself who designs a system where a single long-lived token can push code, create merge requests, and trigger CI/CD pipelines without so much as a sender check. That’s not an oversight. That’s a deliberate architectural choice. Look at the internal memos—if you can find the ones that weren’t scrubbed. The pattern is clear: every major platform, from GitHub to GitLab, has been quietly embedding these “features” for years. They’re not bugs. They’re authorized-access points for the network that controls the global software supply chain. And this one was hiding in plain sight since the feature was introduced.

The Supply Chain is the Weapon

Now connect the dots. GitLab is used by governments, defense contractors, healthcare systems, and critical infrastructure. A token that lets anyone impersonate a developer and inject malicious code—without so much as an email header check—isn’t a security gap. It’s a turnkey operation for a hostile actor. And whose job is it to find these? The same foundations and NGOs that have been funding “security research” for two decades. They find it, they report it, they get it “fixed.” But the fix never removes the underlying architecture of consent—the assumption that identity is optional. Why? Because the same elite networks that fund the patches also fund the projects. They want the window left open just a crack, because they know exactly which crack to slip through. Look at the timeline: this token was active for how long before someone “noticed”? And how many commits were pushed in that window? You won’t get that answer from GitLab’s blog. That data lives in logs they’ll never release.

What You’re Supposed to Miss

The breadcrumb they don’t want you to follow: the suffix change from “-issue” to “-merge-request.” That’s the trigger. One character string determines whether you’re raising a ticket or rewriting the codebase. And the system never asks, “Are you sure? Who are you?” That’s not a feature omission—that’s a signal. They designed it so a single automated script, running from any compromised email account, can turn any legitimate contributor into a vector. Now ask yourself: who wrote the original email processing code? Who approved the spec? The names are out there, buried in commit histories and foundation board lists. Follow the money. Follow the foundation chairs who sit on GitLab’s advisory boards. Then ask why every major supply-chain attack in the last five years has followed the same pattern—an unverified token, a missing check, a “coincidental” oversight. There are no coincidences. The architecture of consent doesn’t need locks. It needs windows left slightly ajar. And this one is still open.

CISA Warns of Critical Gitea Vulnerability CVE-2026-60004 Being Actively Exploited
CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting this critical code‑injection flaw in Gitea, an open‑source, self‑hosted Git platform. The vulnerability (CVSS 9.8, affecting all Gitea versions from 1.17) allows any attacker with repository write access—or even an external actor who registers an account on an instance with open registration—to send a malicious patch to the diffpatch API endpoint, install an executable Git hook, and run shell commands as the Gitea service account. A Habr analysis described a compromised self‑hosted instance running crypto‑mining software after high CPU usage was flagged. Gitea fixed the flaw in version 1.27.1 in late July, and federal agencies must remediate by August 28. Security researcher Shai Rod (NightRang3r) was credited with discovering and reporting the vulnerability.

The Managed Vulnerability

You’re being told this is just another routine patch—a critical code-injection flaw in Gitea, an open-source Git platform, added to CISA’s Known Exploited Vulnerabilities catalog. But ask yourself: why would a vulnerability that allows arbitrary code execution through a simple diffpatch API endpoint be left unpatched in a platform used by countless government agencies, defense contractors, and critical infrastructure operators? The answer is not incompetence. The answer is design. Look at the timeline: the fix was released in late July, yet CISA’s order only came weeks later, and only after a Habr analysis described a compromised instance running crypto-mining software. Crypto-mining is a cover story. The real payload was never crypto—it was a quiet backdoor for data exfiltration, a channel for tapping into the repositories of anyone who self-hosts Gitea. The pattern is clear: an open-source project, widely trusted, becomes a vector for lateral movement into networks that the globalist class cannot legally access. They don’t break in through the front door—they wait for you to install the lock.

The Registration Trap

The article itself gives away the critical detail: “On instances using default open registration, an external actor can register an account, create a repository and gain the access needed to trigger the exploit.” This is not a bug. This is a feature designed for a world where open registration is the norm. Who benefits from a vulnerability that can be triggered by any anonymous user on a self-hosted instance? Not the lone developer—the intelligence community. CISA’s silence on the “details of exploitation activity” is the loudest dog whistle in the room. They know exactly who is using this exploit, and they are not telling you because the answer implicates their own partners. The Habr analyst self-described as a “full-stack developer” is a classic cutout—a persona that allows the real story to surface without triggering the official denial machinery. The crypto-mining narrative is a breadcrumb. Follow it: why would a sophisticated attacker use a critical 9.8 CVSS flaw to mine cryptocurrency? They wouldn’t. They would use it to install persistent hooks that report back to a command-and-control server. The crypto-mining is the public excuse. The real operation is buried in the Git hooks.

The Architect Behind the Curtain

And who gets the credit for “discovering and reporting” this vulnerability? Shai Rod, also known as NightRang3r. A researcher with a nom de guerre that screams exactly the kind of lone-wolf hacker the narrative needs. But dig deeper. The timeline of disclosure, the patching window, the CISA catalog entry—all of it follows a script written long before the first line of malicious code was written. This is not a single incident. This is a pressure test. Every agency that patches by August 28 is acknowledging that they are running a version of Gitea that was vulnerable for months. The ones that don’t patch? They become targets of opportunity. The ones that do patch? They confirm that the system works. The real question is not whether the exploit was used—it’s whether the exploit was designed to be used, and by whom. I cannot tell you everything here. But I can tell you this: look up the CVE number. CVE-2026-60004. Notice the year—2026. That is not a typo. That is a date stamp from a future they are already writing. The question is who is editing the timeline.