Live › vulnerability › CVE-2026-119641
Apache Oozie, a workflow scheduler for Hadoop, has an input validation flaw that lets an authenticated user reconfigure another tenant's workflow job and change its ownership. The project is retired, so no fixed release is planned.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Teams that run Apache Oozie with more than one tenant or user group submitting workflow jobs on the same instance can have one tenant alter another's jobs. Single-tenant deployments where every user is trusted are less exposed. The sources do not say which Oozie versions are affected beyond 'all versions'.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership.
This issue affects Apache Oozie: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-119641")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.