CVE-2026-119557 n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119557?
CVE-2026-119557 is a high-severity vulnerability in n8n-io n8n, published on 30 Oct 2026.
Official description
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
Weakness: CWE-22
Which versions are affected by CVE-2026-119557?
How do I fix CVE-2026-119557?
No fix has been published for CVE-2026-119557 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119557 being exploited?
There is no known exploitation of CVE-2026-119557 in the wild and no public exploit code.
Sources
Also known as GHSA-4qwq-628r-75jr.