Apache Oozie workflow rerun bypasses ACL and reassigns ownership
Original title: CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership
Authenticated Oozie users can reconfigure other tenant's workflows and change ownership in all versions (CVE-2026-119641).
An improper input validation vulnerability in Apache Oozie allows an authenticated user to reconfigure another tenant's workflow job and reassign ownership. This issue affects all versions of Apache Oozie. The project is retired and no fix is planned. Users are recommended to find an alternative.
Unconfirmed: The project being retired is noted by the reporter.
- Affects all versions of Apache Oozie
- Authenticated users can reconfigure other tenants' workflows
- No fix planned as project is retired
- CVE-2026-119641
Impact: reconfiguration of other tenant's workflow job and ownership change
- 1.Find an alternative to Apache Oozie
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119641 | Improper input validation in Apache Oozie allowing ownership reassignment | 6.5 | — |
From the original article
Posted by Arnout Engelen on Nov 02 Severity: moderate Affected versions: - Apache Oozie: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership. This issue affects Apache Oozie: all versions.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.