CVE-2026-119641: UNSUPPORTED WHEN ASSIGNED Improper input validation vulnerability in Apache Oozie
Affects oozieSource GCVE Database
Not known to be exploited · end of life, no fix coming : replace or isolate oozie; no fix will be released.
Data as of 3 Nov 2026, 13:29 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- None coming – the product is end of life
Exploitation evidence
Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.
What to do
No fix will be released: oozie is end of life. Replace it, or isolate it from untrusted networks until you can.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.apache.oozie/ooziepkg:maven/org.apache.oozie/oozieOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users are advised to restrict access to the Oozie instance to trusted users only or migrate to an alternative workflow management solution.
Description
Apache Oozie has an improper input validation vulnerability that allows an authenticated user to reconfigure another tenant's workflow job and change its ownership. This affects all versions of Apache Oozie. The project is retired and no fix will be released. Users should restrict access to trusted users or find an alternative solution.