Is CVE-2026-119557 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119557 being exploited in the wild.

How severe is CVE-2026-119557?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

Is there a fix for CVE-2026-119557?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119557 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119557?

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119557: n8n path traversal in Databricks node

CVE-2026-119557 · Severity: medium · CVSS 5.9 · Published 2026-10-30

n8n is a workflow automation platform that connects business applications and services. A path traversal vulnerability in the Databricks node allows attackers to reach arbitrary Databricks API endpoints through webhook inputs, potentially exposing stored secrets and credentials. The vulnerability requires a victim workflow that has bound untrusted input to Databricks parameters, but exploitation is unauthenticated and could lead to credential compromise on the Databricks tenant.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-119557 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119557 being exploited in the wild.
How severe is CVE-2026-119557?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: N8n 2.14.0 through 2.46.3.
Is there a fix for CVE-2026-119557?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119557 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119557?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Databricks Genie, Vector Search, and Files nodes concatenate user-supplied identifiers (spaceId, indexName, filePath) directly into API endpoint URLs without URL encoding or path validation. Attackers inject ../ sequences and query strings via webhook, chat, or form inputs to traverse to arbitrary API endpoints like /api/2.0/secrets/get. The vulnerability requires a workflow that maps untrusted input to these parameters and uses the Databricks credential; the attacker gains read access to secrets stored in the Databricks workspace.

Affected products

n8n n8n 2.14.0 through 2.46.3

Timeline

2026-09-29: disclosed
2026-10-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.