Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119557n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node

Medium 5.9

In plain English

A medium-severity path traversal in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	2.14.0 – through 2.46.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/genie/getSpace.operation.ts#L14-L18 technical-description
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/vectorSearch/getIndex.operation.ts#L12 technical-description
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/files/downloadFile.operation.ts#L27 technical-description
GitHub Security Advisory (GHSA-89p4-6h98-c7xm) related, vendor-advisory
GitHub Security Advisory (GHSA-rqch-9jrh-cr8w) related, vendor-advisory
https://abraxaslabs.tech/research/n8n-databricks-path-join third-party-advisory
https://github.com/n8n-io/n8n product
VulnCheck Advisory: n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node third-party-advisory