workflow job and change its ownership.
This issue affects Apache Oozie: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 03 Nov 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 03 Nov 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |
| Title | Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership | |
| Weaknesses | CWE-20 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-11-03T10:07:57.037Z
Reserved: 2026-10-30T13:28:00.309Z
Link: CVE-2026-119641
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-03T10:17:14.987
Modified: 2026-11-03T10:17:14.987
Link: CVE-2026-119641
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-03T10:30:13Z