n8n from 2.14.0 through 2.46.3 contains a path traversal flaw in the Databricks node that allows any unauthenticated attacker to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. By supplying ‘../’ sequences and query strings through webhook, chat, or form inputs that map to the spaceId, indexName, or filePath parameters, an attacker can read secrets that are protected by the stored Databricks credentials. The primary consequence is the disclosure of confidential credentials and potentially other data exposed by Databricks, representing a significant confidentiality breach.

n8n-io’s n8n product, versions 2.14.0 through 2.46.3, is affected. The vulnerability resides in the Databricks node implementation and applies to all configurations where this node is enabled.

The CVSS score of 8.2 indicates moderate to high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The flaw requires no authentication and can be exploited via publicly accessible webhook, chat, or form inputs. Attackers can traverse directories and specify arbitrary API calls, making compromise straightforward once the inputs are controlled. Given the lack of a publicly known exploit and the absence of KEV listing, the risk remains primarily driven by the high CVSS score and the ease of exploitation through input manipulation.