Cyber ·
CVE-2026-119641: Apache Oozie lets authenticated users change another tenant's workflow and ownership
Advisory published on November 2, 2026 in the oss-sec feed: an authenticated Apache Oozie user can reconfigure another tenant's workflow and change its ownership. Severity moderate, all versions affected, project discontinued with no fix planned.
Advisory CVE-2026-119641 describes improper input validation in Apache Oozie, a workflow orchestration system. According to the machine-translated text from the oss-sec feed, published by Arnout Engelen on November 2, 2026, an already authenticated user can reconfigure a workflow belonging to another tenant and change that workflow's ownership. Severity is rated moderate, and the advisory states that all Apache Oozie versions are affected.
For operators, the key point is that the project is discontinued, so maintainers say they do not plan to release a fixed version. The advisory recommends that users find an alternative, without naming one. The full analysis should be done from the original source, which carries the complete text and any later updates.
This is a cross-tenant access control issue in workflow software, not an AI model issue. Anyone still running Oozie should review tenant isolation, permissions to create and modify workflows, and ownership records, and plan a migration.