New research: How n8n and GitLab paid $1M+

Black Hat USA 2026

Eliminating Vulnerability Classes at Scale in the Post-Mythos Era

By Jeevan Jutla

We traced every vulnerability n8n and GitLab have publicly disclosed back to the commit that fixed it. Most were repeats of problems already patched elsewhere. This pack is the executive brief and the complete evidence behind the talk.

105

root causes across 569 findings

$1M+

bounties paid for repeats

728 days

longest-lived class

1,117

duplicate backports

Share of disclosures that re-fixed a known root cause

n8n67% of public disclosures were repeats
GitLab58% of CVEs were repeats

Key takeaways

  • The same bugs keep coming back

    67% of n8n disclosures and 58% of GitLab CVEs re-fixed a root cause that had already been patched somewhere else in the codebase.

  • 569 findings are really 105 design decisions

    What looks like an unmanageable backlog is a short list of root causes. Fix the class once, at a shared point, and it stays fixed.

  • Recurrence is expensive and invisible

    The repeats cost ~$44k at n8n and over $1M at GitLab in bounties alone. None of it shows up in MTTR or fix rate.

Explore all 569 findings

Search by class, disclosure, or fix commit, and open a class to see its prevention rule and every finding assigned to it.