CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership

Published Nov 2, 2026

Updated

UNSUPPORTED WHEN ASSIGNED Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership.

This issue affects Apache Oozie: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Event History

Nov 3, 2026

CVE Published

via NVD·10:17 AM

Data Sourced

via NVD·10:17 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Oozie user can exploit it. The issue is relevant where users from different tenants can access the same Oozie instance.

What could an attacker do after exploiting it?

They can reconfigure another tenant's workflow job, bypass the per-job ACL, and change the job's ownership.

Is a vendor fix available?

No fix is planned because Apache Oozie is retired and unsupported. The recommended action is to move to an alternative or restrict the instance to trusted users.

CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker do after exploiting it?

Is a vendor fix available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker do after exploiting it?

Is a vendor fix available?