Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-119557 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://abraxaslabs.tech/research/n8n-databricks-path-join	[email protected]	Broken LinkTechnical Analysis
https://github.com/n8n-io/n8n	[email protected]	Vendor
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/files/downloadFile.operation.ts#L27	[email protected]	Source CodeVendor
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/genie/getSpace.operation.ts#L14-L18	[email protected]	Source CodeVendor
https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/vectorSearch/getIndex.operation.ts#L12	[email protected]	Source CodeVendor
https://github.com/n8n-io/n8n/security/advisories/GHSA-89p4-6h98-c7xm	[email protected]	AdvisoryRemedyVendor
https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/n8n-from-2.14.0-through-2.46.3-path-traversal-via-databricks-node	[email protected]	AdvisoryBundleRemedy

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
n8n	>= 2.14.0, <= 2.46.3 (semver)
CPE cpe:2.3:a:n8n:n8n::::::node.js::* Remediation Upgrade: 2.40.1moderate effort Upgrade: 2.39.6moderate effort Upgrade: 1.123.80moderate effort Mitigation:low effort Restrict n8n instance access to fully trusted users only. Mitigation:low effort Audit all workflows that use the n8n node and ensure that ID fields are not bound to expressions sourced from untrusted or externally supplied input. Mitigation:low effort Restrict or disable public webhook endpoints that feed into workflows using the n8n node until the instance is patched. Mitigation:low effort Review and rotate any API credentials that may have been exposed via workflows using the n8n node with expression-bound ID fields.

Product

Versions

n8n

>= 2.14.0, <= 2.46.3 (semver)

CPE

cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*

Remediation

Upgrade: 2.40.1moderate effort
Upgrade: 2.39.6moderate effort
Upgrade: 1.123.80moderate effort
Mitigation:low effort
Restrict n8n instance access to fully trusted users only.
Mitigation:low effort
Audit all workflows that use the n8n node and ensure that ID fields are not bound to expressions sourced from untrusted or externally supplied input.
Mitigation:low effort
Restrict or disable public webhook endpoints that feed into workflows using the n8n node until the instance is patched.
Mitigation:low effort
Review and rotate any API credentials that may have been exposed via workflows using the n8n node with expression-bound ID fields.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 30, 2026	CVE Modified	CISA-ADP
Oct 30, 2026	New CVE Received	[email protected]