CVE-2026-119557: n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node

Published Oct 30, 2026

Updated

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:31 AM

Data Sourced

via MITRE·11:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed?

Instances running n8n versions 2.14.0 through 2.46.3 are affected when a Databricks node accepts webhook, chat, or form input mapped to the spaceId, indexName, or filePath fields. Exploitation targets the Databricks credential stored by that node.

What does an attacker need to exploit this issue?

The attacker does not need authentication, but must be able to submit input through a webhook, chat, or form flow that is mapped to a vulnerable Databricks node parameter. They inject unencoded ../ sequences and query strings into the mapped resource identifier.

What is the impact of successful exploitation?

An attacker can traverse the intended Databricks API path and reach arbitrary Databricks API endpoints using the stored Databricks credential. This can allow reading secrets accessible through that credential.

What can be done if upgrading is not immediately possible?

Prevent untrusted webhook, chat, and form input from being mapped directly to Databricks spaceId, indexName, or filePath fields. Restrict access to workflows using the Databricks node until those values can be validated or the affected version can be replaced.

CVE-2026-119557: n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?