CVE-2026-119641

UNKNOWN 0.0

Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CWE	CWE-20
Vendor	apache software foundation
Product	apache oozie
Published	Nov 3, 2026
Last Updated	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache oozie

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache oozie are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Oozie

0 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/b0vh3rxt3dbdvyz44210q2sz3201213p openwall.com: http://www.openwall.com/lists/oss-security/2026/11/02/4

Credits

🔍 Hari (Harikrishna KP)