Exposed GitLab Token Had Owner Access to 55 Open-Source Projects
Summary
A public GitLab CI artifact exposed a token with Owner access to 55 open-source projects, including GnuTLS. Maintainers revoked it and fixed the pipeline; a review found no unauthorized commits or altered webhooks.
Key points
- A GitLab personal access token with the api scope and Owner access to 55 projects was exposed in a public CI artifact.
- The token could enable direct code pushes to a GnuTLS release branch and changes to branch-protection rules.
- A test script dumped runner environment variables, and a Fedora job published the resulting file as an untracked public artifact.
- The article says the token was exposed on every run from January 11, 2026.
- Maintainers revoked the token and removed the environment-dump commands after disclosure.
- A review found no unauthorized commits or altered webhooks, and no malicious code reached public releases.
Article Details
- Victim Organization
- GnuTLS and OpenConnect projects
- Incident Type
- Exposure of a privileged GitLab personal access token in a publicly accessible CI artifact
- Disclosure Date
- 2026-09-09
- Data Types Exposed
- GitLab personal access token with api scope and Owner access
- Affected Records
- One API token
- Operational Impact
- The exposed token could make direct code pushes to maintained projects and alter branch protection rules. The article reports no unauthorized commits, altered webhooks, code changes, or impact to individuals; the token was revoked and the pipeline configuration patched.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
People
Products
CUPSIt ships with CUPS printing systems and networking tools like cURL.curlIt ships with CUPS printing systems and networking tools like cURL.GitLabData exposed: Privileged GitLab personal access tokenGnuTLSGnuTLS Token Leak Threatens Open Source Supply Chainlibtasn1These included GnuTLS, Nettle, libtasn1, and ocserv.NettleThese included GnuTLS, Nettle, libtasn1, and ocserv.ocservThese included GnuTLS, Nettle, libtasn1, and ocserv.