Do Son 
Image: Truffle Security
At a glance
Truffle Security researchers found a critical GnuTLS token leak on June 17, 2026. This exposure threatened the entire open-source supply chain.
- Organization: GnuTLS and OpenConnect projects
- Data exposed: Privileged GitLab personal access token
- Number of records: One API token with Owner access
- Cause: Environment variables dumped into public log files
- Disclosure status: Confirmed, patched, and token revoked
- Source: Truffle Security research team
TL;DR
Researchers discovered a GnuTLS token leak inside a public repository. The token allowed direct code pushes to critical libraries. Maintainers quickly revoked the credential to prevent supply chain attacks.
What Was Exposed
Researchers discovered a GitLab CI artifact exposure containing a personal access token. The token held the api scope. This scope grants complete read and write access across multiple groups. The credential maintained Owner status on 55 different open-source projects. These included GnuTLS, Nettle, libtasn1, and ocserv. The token allowed direct pushes to the maintained gnutls_3_7_x release branch. The token could also alter protection rules on default branches.
How It Happened
The GnuTLS token leak resulted from a flawed continuous integration pipeline. The openconnect/ocserv project ran a test script called tests/connect-ios-script. This script executed a command to dump the entire system environment. It wrote all runner variables into a temporary file. A Fedora testing job then published this file as an untracked public artifact. Anyone could download the file without authentication. A valid token remained exposed on every run from January 11, 2026.
Who Is Affected
GnuTLS is a core dependency for major Linux distributions. It ships with CUPS printing systems and networking tools like cURL. A malicious actor could have compromised millions of end users. Fortunately, the exposure did not lead to a data breach or code alteration. Maintainers confirmed that no individuals were actually affected.
What Affected People Should Do
End users and system administrators do not need to take any action. No malicious code reached the public releases. However, software developers must secure their build pipelines. Teams should prevent test scripts from logging or dumping raw environment variables. Developers should audit artifacts for exposed secrets.
The Company Response
Truffle Security sent a disclosure report directly to the project maintainers. The maintainers responded within hours and revoked the token. They patched the configuration by removing the environment dump commands. The account owner then reviewed all project activity. They found no unauthorized commits or altered webhooks.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
