Exposed GitLab Project Email Addresses Could Let Attackers Push Malicious Code

What Happened

According to BleepingComputer, private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in public-facing locations such as READMEs, contributing guides, and support pages set up to collect bug reports. These addresses exist as a convenience feature — GitLab lets certain project emails create issues or content via email — but when publicly disclosed, they can be abused by anyone who obtains them, not just intended contributors.

Why It Matters

If an attacker obtains one of these exposed addresses, they may be able to interact with a project in ways that were meant to be limited to trusted contributors or automated tooling, including pushing content such as issues or tasks. For teams relying on these email-to-GitLab integrations, this could open a path for unauthorized or malicious submissions into a project's workflow, particularly where those submissions feed into review or CI processes with insufficient scrutiny. The report frames this as a technique-level exposure issue rather than a specific vulnerability in GitLab itself — the risk stems from how these addresses are published and handled, not a confirmed software flaw.

What Defenders Should Watch For

• Audit READMEs, CONTRIBUTING files, wikis, and support pages for any GitLab project email addresses that are publicly listed and confirm whether they were intentionally exposed.
• Review GitLab project settings for email-based issue/task creation features and restrict or rotate any addresses that don't need to be public.
• Treat content or issues originating from email-based submissions with the same scrutiny as untrusted external contributions — require review before any associated code reaches merge or CI pipelines.
• Monitor project activity logs for issues or tasks created via email from unexpected senders or at unusual volumes.
• Consider whether email-to-issue functionality is necessary for your workflow, and disable or restrict it where it isn't.

Developing Story

Details on this technique are still emerging and the scope of affected projects is not fully known. This post will be updated as more information becomes available. Read the original report from BleepingComputer: Exposed GitLab project email addresses let attackers push code.