# Send GitLab an email, push to main

GitLab's incoming email address embeds a long-lived account-wide token; anyone holding it can push code, run CI/CD, and bypass IP allowlists.

- Payout: Research
- Severity: high
- Program: GitLab
- Write-up by: Aikido Security
- Disclosed: 2026-09-23
- Write-up quality: 8/10
- Original: https://www.aikido.dev/blog/gitlab-email-push-to-main
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-gitlab-email-push-to-main
- Tags: area:web domain:web impact:integrity impact:internal-access kind:research platform:threat-intel sev:high tech:ci-cd technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration vuln:secrets-leak

**Target:** GitLab incoming email (issue-by-email / merge-request-by-email) endpoint
**Root cause:** The private incoming email address embeds a long-lived, account-wide token (glimt- prefix) that authenticates as the owner across all projects, but is presented in the UI as a project-scoped issue-creation address. Sender identity is never verified.
**Steps:**
1. Obtain a leaked project issue-by-email address like `incoming+project-id-glimt-XXXXXXXXXXXXXX-issue@incoming.gitlab.com`
2. Swap `-issue@` for `-merge-request@` in the address
3. Craft a git `.patch` attachment modifying `.gitlab-ci.yml` to add an attacker job
4. Email the patch to the address with the target source branch named in the subject line
5. GitLab pushes the commit to that branch (creating it if absent) and runs the CI/CD job as the victim
**How found:** Noticed the UI framed the address as project-scoped issue creation, then observed the same glimt- token appeared across five different project addresses including private ones, revealing account-wide scope; tested sender spoofing and -merge-request suffix swap.
**Exploitation:** Attacker emails a .patch to the -merge-request address; GitLab applies it to the named source branch and executes the injected .gitlab-ci.yml job as the victim, enabling code push to protected branches, source exfiltration, CI/CD variable theft, and CI_JOB_TOKEN pivot.
**Escalation:** Chained from issue-email to merge-request-email to CI/CD execution; CI_JOB_TOKEN used to reach further into the account; bypasses IP allowlists that block HTTP/SSH.
**Insight:** When a product hands out a 'private address' or share link, extract the embedded token and test it against other resources and alternate suffixes (-issue vs -merge-request) to see if scope matches the UI's claim; also test whether the mail path bypasses network controls like IP allowlists.