CVE-2026-119557

n8n Databricks node identifiers can redirect credentialed API requests

n8n · Databricks Genie, Vector Search and Files node operations

First documented disclosure · Review checkpoint

Summary

Unencoded identifiers can redirect a workflow’s Databricks request to unintended API endpoints.

Severity and exploitation evidence

High · 8.2/10 · CVSS 4.0. Severity source.

Exploitation not established: The original researcher used a loopback mock Databricks service and sentinel data. No real workspace was attacked and no victim compromise is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

spaceId, indexName or filePath is concatenated into request paths without path-segment encoding; traversal and query syntax can change the endpoint while retaining the workflow credential.

Conditions required

A configured workflow maps untrusted webhook, chat or form input into an affected identifier, holds a Databricks credential, and exposes the resulting output. Data access remains bounded by that credential’s Databricks permissions.

Potential impact

Potential disclosure of Databricks secrets or other accessible data through unintended API calls. It does not establish n8n host code execution.

Affected versions and configurations

n8n 2.14.0 through 2.46.3, according to VulnCheck.

Fix and mitigation status

No fixed release established for this Databricks path in the reviewed sources.

Practical next steps

Stop binding untrusted values to affected resource identifiers, restrict or disable exposed workflows, and minimize Databricks token permissions. Apply a verified fix that encodes each path segment; sibling-node patches do not resolve this path by inference.

Operating lesson

A trusted API hostname does not prevent credential misuse when untrusted input can select an unintended path.

Evidence and limits

The researcher published September 29; CNA publication followed October 30 and expands the affected range through 2.46.3. GHSA-89p4-6h98-c7xm and GHSA-rqch-9jrh-cr8w concern n8n Public API and Supabase siblings, not a proven Databricks fix or aliases for this CVE. LangChain VectorStoreDatabricks already encodes its index path and is an explicitly distinct control. CNA CVSS 4.0 is 8.2; the researcher’s 8.6 score uses CVSS 3.1 and different assumptions.

Sources