HIGH 8.2 NVD
CVE-2026-119557
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databrick
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
References
- https://abraxaslabs.tech/research/n8n-databricks-path-join
- https://github.com/n8n-io/n8n
- https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actio
- https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actio
- https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actio
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.