| Component | n8n |
| Severity | medium (CVSS 5.9) |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published (NVD) | 2026-10-30 |
| Affected versions | >= 2.14.0, <= 2.46.3 from the CVE Program record written by the CNA that assigned the CVE |
| Fixed in | see the vendor advisory |
| Weakness | CWE-22 |
| CISA KEV | not listed |
Versions, checked against NVD
NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above come from the CVE record written by VulnCheck, the CNA that assigned the CVE.
NVD description
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
What to do
- No fixed release is known yet: follow the vendor advisory below and keep n8n off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-119557
- https://abraxaslabs.tech/research/n8n-databricks-path-join
- https://github.com/n8n-io/n8n
- https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/files/downloadFile.operation.ts#L27
- https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/genie/getSpace.operation.ts#L14-L18
- https://github.com/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/vectorSearch/getIndex.operation.ts#L12
- https://github.com/n8n-io/n8n/security/advisories/GHSA-89p4-6h98-c7xm
- https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w
- https://www.vulncheck.com/advisories/n8n-from-2.14.0-through-2.46.3-path-traversal-via-databricks-node