The token that could have broken the internet: major supply chain attack averted
Luckily, researchers were the first to find it.
Open source under attack. Image by Cybernews, Unsplush/Insaanu Studio.
- An exposed GitLab token had Owner-level access to 55 projects, including GnuTLS.
- The token could have pushed code to an official GnuTLS release without approval.
- A faulty GitLab CI process published the secret in a public file for a day.
- Maintainers revoked the token, fixed the bug, and found no malicious commits.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Security researchers have found an exposed GitLab token with extraordinary power, capable of causing a devastating internet-wide supply chain attack. The token could push code directly to GnuTLS, a major internet security library, and to 55 other important projects.
The exposed GitLab personal access token was discovered by Truffle Security, a cybersecurity firm specializing in detecting secret leaks.
It had the api scope and Owner-level access to 55 projects, the most sensitive of which was GnuTLS. It could have been abused to push code directly to an official version (release line) of the software, without a merge request or approval.
GnuTLS is a major open-source SSL, TLS, and DTLS protocol implementation used in many projects to secure connections across the internet. It ships with nearly every major Linux distribution, powers networking tools such as Wget or cURL, and is a dependency for countless other apps.
“We Almost Owned the Internet's TLS,” Truffle Security said in the headline of its report.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The same token had the Owner’s access in other GnuTLS projects, including Nettle, two foundational software libraries libtasn1 and libidn2, and ocserv, OpencConnect’s VPN server.
Had attackers gotten their hands on it first, the consequences could have been devastating. They could’ve compromised a critical dependency used by major software packages, potentially harvesting even more sensitive credentials from other developers.
The master key was sitting in a public file in plain text, available for anyone to download.
It was exposed in a file produced by a faulty GitLab CI (Continuous Integration) process: an automated test dumped the entire environment, including secrets, into a file, and the pipeline was configured to publish it publicly. That file stayed online for a day and could be accessed without authentication.
“The leak resulted from three parts of the CI configuration in the public openconnect/ocserv project that combined to write the token into a downloadable artifact,” Truffle Security said.
The report found that the pipeline had been repeatedly exposing the secret in publicly accessible files since January 11th, 2026.
Truffle Security disclosed the bug on June 17th, 2026, and maintainers shipped a fix within a few hours. The mighty token has also been revoked.
Maintainers reviewed activity across the project associated with it and found no malicious commits or other activity.