CVE-2026-119557: n8n: Databricks node path traversal leaks secrets

MEDIUM

Published October 30, 2026

CISO Take

A path traversal flaw in n8n's Databricks node (2.14.0 through 2.46.3) lets an unauthenticated attacker inject ../ sequences and query strings through webhook, chat, or form inputs mapped to spaceId, indexName, or filePath, redirecting requests to arbitrary Databricks API endpoints under the workflow's stored credential. Severity is medium (CVSS 5.9, high attack complexity) because exploitation depends on a workflow that wires untrusted input into those fields, but where that pattern exists the attacker effectively borrows your Databricks identity and can read data and secrets. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so likelihood is low today, though the n8n package has 277 other CVEs and 16 tracked downstream dependents, and n8n is a frequent target. Upgrade to the patched n8n release listed in the vendor advisories (GHSA-89p4-6h98-c7xm, GHSA-rqch-9jrh-cr8w), and until then audit workflows that feed public triggers into Databricks nodes and scope the Databricks token to least privilege.

Sources:NVDGitHub AdvisoryOpenSSFATLASvulncheck.comabraxaslabs.tech

What is the risk?

Medium overall. CVSS 5.9 reflects high confidentiality impact with high attack complexity, no privileges and no user interaction. Exploitability depends on a workflow exposing a public webhook, chat or form trigger whose input reaches the Databricks node's resource identifier fields. Where that holds, the attacker acts with the stored Databricks credential, so real impact scales with that token's permissions (workspaces, Genie spaces, vector indexes, files, secrets). No known exploitation, no public PoC, no scanner template and no EPSS data at publication. Risk is higher for internet-exposed n8n instances using broadly scoped Databricks service tokens.

How does the attack unfold?

Initial Access

Attacker finds a public n8n webhook, chat or form trigger wired to a Databricks node's spaceId, indexName or filePath.

AML.T0049

Exploitation

Attacker injects ../ sequences and query strings so the node requests an arbitrary Databricks API endpoint.

AML.T0053

Credential Abuse

The request is authenticated with the stored Databricks credential, which returns secrets or protected data.

AML.T0098

Impact

Secrets and data are returned in the workflow response, enabling follow-on access to data and ML platforms.

AML.T0085.001

Initial Access

Attacker finds a public n8n webhook, chat or form trigger wired to a Databricks node's spaceId, indexName or filePath.

AML.T0049

Exploitation

Attacker injects ../ sequences and query strings so the node requests an arbitrary Databricks API endpoint.

AML.T0053

Credential Abuse

The request is authenticated with the stored Databricks credential, which returns secrets or protected data.

AML.T0098

Impact

Secrets and data are returned in the workflow response, enabling follow-on access to data and ML platforms.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade n8n to the fixed version stated in the vendor advisories (above 2.46.3) as soon as it is validated. 2) Until patched, remove or gate public webhook, chat and form triggers that feed spaceId, indexName or filePath in Databricks nodes; add validation nodes rejecting '..', '/', '?', '#' and '%2e' characters. 3) Rotate and minimize the Databricks personal access token or service principal used by n8n to least privilege, and restrict secret scopes it can read. 4) Review n8n execution logs and Databricks audit logs for unexpected API paths, secret reads, or anomalous file and index access since 2.14.0 was deployed. 5) Place n8n webhooks behind authentication, WAF, or IP allowlists where possible.

How is it classified?

Data ExtractionData LeakageAgentPluginRAGAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and managing AI system vulnerabilities

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-119557?

Is CVE-2026-119557 actively exploited?

No confirmed active exploitation of CVE-2026-119557 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-119557?

1) Upgrade n8n to the fixed version stated in the vendor advisories (above 2.46.3) as soon as it is validated. 2) Until patched, remove or gate public webhook, chat and form triggers that feed spaceId, indexName or filePath in Databricks nodes; add validation nodes rejecting '..', '/', '?', '#' and '%2e' characters. 3) Rotate and minimize the Databricks personal access token or service principal used by n8n to least privilege, and restrict secret scopes it can read. 4) Review n8n execution logs and Databricks audit logs for unexpected API paths, secret reads, or anomalous file and index access since 2.14.0 was deployed. 5) Place n8n webhooks behind authentication, WAF, or IP allowlists where possible.

What systems are affected by CVE-2026-119557?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation, RAG pipelines, Vector databases, Data lakehouse integrations.

What is the CVSS score for CVE-2026-119557?

CVE-2026-119557 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automationRAG pipelinesVector databasesData lakehouse integrations

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.

Exploitation Scenario

An organization runs an n8n chatbot workflow on a public chat trigger that takes a user-supplied document name and passes it to the Databricks 'Download File' operation as filePath. The attacker submits a value like '../../secrets/get?scope=prod&key=api' or appends a query string, causing n8n to call a different Databricks API endpoint with the stored credential. The response containing secret or data content is returned through the workflow output, giving the attacker data and credentials that can be used to reach further data and ML systems.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.