A long-lived GitLab incoming email token embedded in project email addresses for the >>Email work item<< feature can be exploited to push attacker-controlled code, create merge requests, and trigger CI/CD pipelines using the permissions of the token owner. This issue can also bypass GitLab's IP restrictions, as incoming email is explicitly excluded from those controls. […] The post GitLab Email Token Lets Attackers Push Code to Main and Execute CI/CD Jobs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
First seen on gbhackers.com
Jump to article: gbhackers.com/gitlab-email-token/
