---
id: "CVE-2026-119641"
kind: "vulnerability"
aliases: ["CVE-2026-119641"]
title: "Apache Oozie: authenticated users can take over other tenants' workflow jobs"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apache-oozie", "hadoop", "infrastructure", "self-hosted"]
not_affected_if: ["single-tenant", "trusted-users-only"]
published_at: "2026-11-03T10:17:14+00:00"
first_seen_at: "2026-11-03T10:20:15+00:00"
updated_at: "2026-11-03T10:20:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119641", "first_seen_at": "2026-11-03T10:20:15+00:00"}]
---

# Apache Oozie: authenticated users can take over other tenants' workflow jobs

Apache Oozie, a workflow scheduler for Hadoop, has an input validation flaw that lets an authenticated user reconfigure another tenant's workflow job and change its ownership. The project is retired, so no fixed release is planned.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether an Apache Oozie instance is deployed, for example by looking for the Oozie server process or its installed package version.
- Confirm whether multiple tenants or teams share the same Oozie instance and can submit jobs.

## Fix

- Apache Oozie: no fixed version; the sources say the project is retired and recommend finding an alternative or restricting access to trusted users.

## Timeline

- 2026-11-03T10:20:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119641

## From the sources

** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's
workflow job and change its ownership.



This issue affects Apache Oozie: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_