TRUFFLE Security researchers detected a critical token leak tied to GnuTLS in June 2026, exposing a GitLab personal access token used by a public CI artifact. The token carried api scope and Owner privileges across 55 open‑source projects, including GnuTLS, Nettle, libtasn1, and ocserv. The exposed credential could have enabled direct pushes to a key release branch (gnutls_3_7_x) and the ability to alter branch protection rules in default branches. The incident did not trigger a known data breach in public releases, and maintainers report that no individuals were actually affected.
How the leak happened is central to the lesson: an openconnect/ocserv test script dumped the runner environment to a temporary file, which was published as an untracked public artifact by a Fedora testing job. This allowed anyone to download the file without authentication, and a valid token appeared in every run from 11 January 2026.
In response, maintainers revoked the token, patched the configuration to remove the environment dump, and reviewed activity with no evidence of unauthorized commits or webhook alterations. End users did not need to take action, but developers are urged to secure CI pipelines, stopping test scripts from logging environment variables and auditing artifacts for secrets. The disclosure came via Truffle Security, with prompt reprovisioning by the project maintainers.