Story thread · 2 reports / 2 sources
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
thehackernews.com · 10h · first report
The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored
The coverage
- GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks
darkreading.com · 6h
The conversation · 0
Sign in to join the conversation.
No comments yet — start the thread.