Path Traversal Vulnerability in n8n Databricks Node
CVE-2026-119557

8.2HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119557?

The n8n automation tool, specifically versions from 2.14.0 to 2.46.3, is susceptible to a path traversal vulnerability located in the Databricks node. This flaw allows unauthenticated attackers to exploit the system by injecting unencoded resource identifiers, leading to unauthorized access to arbitrary Databricks API endpoints. Attackers can manipulate inputs through webhooks, chats, or forms tied to parameters such as spaceId, indexName, or filePath. This vulnerability can potentially expose sensitive information, including secrets stored using credentials.

Affected Version(s)

n8n 2.14.0 <= 2.46.3

References

https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/...
technical-description
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/...
technical-description
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.