Exposed GitLab Project Email Addresses Enable Unauthorized Code Pushes

According to a report published by BleepingComputer on September 24, 2026, a growing number of GitLab private projects have their project email addresses deliberately exposed in public-facing documentation such as READMEs, contributing guides, and bug report support pages. These email addresses are designed to allow developers to submit issues or tasks via email, but when made publicly accessible, they can be abused by attackers.

The mechanism relies on GitLab's email-to-code-push functionality. By sending emails to these exposed addresses, threat actors can inject commits into projects that are otherwise configured as private. The report indicates that the abuse does not exploit a software flaw in GitLab itself, but rather takes advantage of misconfigured project settings and the public disclosure of contact emails in documentation meant to facilitate contributions.

Impact assessments cited in the report suggest that unauthorized code injection could lead to supply chain attacks, exposure of proprietary code, and the insertion of malicious functionality into private repositories. The scope of impact depends largely on the specific visibility and access settings of each project.

GitLab administrators and project owners are advised to review their documentation for exposed project email addresses, restrict project visibility settings where possible, and monitor incoming emails to project addresses for suspicious activity. As of the report date, no official patch has been issued, as the issue is primarily addressed through configuration and operational best practices.