{"id":"CVE-2026-119641","aliases":["EUVD-2026-115731","GHSA-f89p-cqv9-7c2r"],"status":"published","title":"Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00365,"percentile":0.30571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2026-11-03T09:41:17Z","modified":"2026-11-06T19:55:40Z","products":[{"vendor":"apache software foundation","product":"apache oozie"}],"references":[{"url":"https://lists.apache.org/thread.html/b0vh3rxt3dbdvyz44210q2sz3201213p","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/02/4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119641"},{"url":"https://github.com/advisories/GHSA-f89p-cqv9-7c2r"}],"sources":{"cve":[{"id":"CVE-2026-119641","title":"Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-11-03T09:41:17.072Z","modified":"2026-11-06T19:55:40.909Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-06T20:30:04.265548Z"}],"euvd":[{"id":"EUVD-2026-115731","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-11-03T09:41:17Z","modified":"2026-11-06T19:55:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-f89p-cqv9-7c2r","title":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An...","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-11-03T12:31:47Z","modified":"2026-11-06T21:31:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-06T21:34:15.587491Z"}],"nvd":[{"id":"CVE-2026-119641","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-11-03T10:17:14.987Z","modified":"2026-11-06T20:17:14.737Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-06T22:02:16.310898Z"}]}}