---
id: CVE-2026-119641
title: 'Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership'
summary: "** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie.\_An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions…"
severity: none
cwe:
  - CWE-20
vendor: Apache Software Foundation
product: 'org.apache.oozie:oozie-main'
affected:
  - 'org.apache.oozie:oozie-main < *'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T10:07:57.037Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119641'
references:
  - url: 'https://lists.apache.org/thread.html/b0vh3rxt3dbdvyz44210q2sz3201213p'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12216
ingestedAt: '2026-11-05T19:30:42.934Z'
---

## Overview

** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's
workflow job and change its ownership.



This issue affects Apache Oozie: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

## Affected

- `org.apache.oozie:oozie-main < *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.