Apache Oozie CVE-2026-119641

Requires a valid authenticated account on an Apache Oozie instance that hosts workflow jobs belonging to more than one tenant/owner; the attacker invokes Oozie's workflow rerun/reconfigure capability against another tenant's existing job, and improper input validation causes the per-job ACL to be bypassed so the job can be reconfigured and its ownership reassigned. Limiting factors that reduce real-world exposure: the instance must be multi-tenant with jobs owned by other users (a single-user or single-tenant deployment has nothing to steal across the boundary); the attacker must already possess authenticated Oozie access; and because Oozie is retired there is no patch, so the only risk reducers are decommissioning the service or restricting it to trusted users as the maintainer advises. No CVSS vector was supplied to independently confirm the access or privilege requirements.

Severity signals for this CVE are sparse and must be weighed carefully. No CVSS vector, EPSS probability, CISA KEV listing, or public exploit was provided; the vuln.today decision label is 'awaiting_data', and the Apache advisory rates it only 'moderate'. There is therefore no quantitative exploitation signal - real-world risk cannot be confirmed from scoring data and is currently indeterminate. The structural risk, however, is meaningful and permanent: the Apache advisory confirms all versions of Oozie are affected, the project was retired (moved to the Attic in April 2025), and the maintainer explicitly will NOT release a fix. The flaw is a cross-tenant authorization bypass - an Oozie user can reconfigure another tenant's workflow job and seize its ownership - which breaks the multi-tenancy trust boundary that an Oozie deployment relies on. Because no patch will ever exist, any still-running Oozie instance carries this risk indefinitely until decommissioned or access-restricted. The practical priority is driven not by exploitation telemetry (which is missing) but by the combination of an unfixable integrity/authorization defect and the deployment context: the risk is concentrated in multi-tenant instances still in production and is low for single-user or decommissioned ones. Note the description states an 'authenticated Oozie user' is required, but no CVSS vector is supplied to independently confirm the privilege level - treat the authentication prerequisite as vendor-described rather than CVSS-confirmed.

On a multi-tenant Apache Oozie instance, an attacker with a valid Oozie user account targets a workflow job belonging to a different tenant and issues a rerun/reconfigure request whose input is not properly validated, bypassing the per-job ACL and reassigning the job's ownership to the attacker. This lets the attacker take over and alter another tenant's scheduled Hadoop workflow. No public exploit identified at time of analysis; the exact trigger mechanism beyond 'improper input validation' is not described in the available sources.