CVE-2026-119557 json
n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
published 2026-10-30 10 d ago modified 2026-10-30 10 d ago also EUVD-2026-113822
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 d ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- n8n-io n8n
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/n8n-io/n8n/security/advisories/GHSA-89p4-6h98-c7xm
related, vendor-advisory
-
github.com
/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w
related, vendor-advisory
-
github.com
/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/genie/getSpace.operation.ts#L14-L18
technical-description
-
github.com
/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/vectorSearch/getIndex.operation.ts#
technical-description
-
github.com
/n8n-io/n8n/blob/n8n%402.45.7/packages/nodes-base/nodes/Databricks/actions/files/downloadFile.operation.ts#L27
technical-description
-
abraxaslabs.tech
/research/n8n-databricks-path-join
third-party-advisory
-
github.com
/n8n-io/n8n
product
-
vulncheck.com
/advisories/n8n-from-2.14.0-through-2.46.3-path-traversal-via-databricks-node
third-party-advisory
Sources
- CVE List CVE-2026-119557
- NVD CVE-2026-119557
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.