Apache Oozie workflow rerun bypasses ACL and reassigns ownership
Authenticated Oozie users can reconfigure other tenant's workflows and change ownership in all versions (CVE-2026-119641).
50
CVE-2026-119641
Improper input validation in Apache Oozie allowing ownership reassignment
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership via improper input validation. All versions are affected. Since the project is retired, no fix is planned; users should restrict access to trusted users or find an alternative.
What to do: No fix available as project is retired. Restrict access to the instance to trusted users or find an alternative.
| Product | Affected |
|---|---|
| Apache Oozie | all versions |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N