Improper input validation in Apache Oozie
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.
Why it matters now
EPSS 0.01484 74th percentileScored 2026-11-07
Fix Fixed org.apache.oozie:oozie-core (Maven): 5.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Oozie | Apache Oozie 3.1.3-incubating to 5.0.0 | — | No fix listed | CNA |
| — | org.apache.oozie:oozie-core (Maven) | before 5.1.0 | 5.1.0 | Patch available | GHSA-wg5w-vv93-3f7w |
- Apache Oozie VendorApache Affected Apache Oozie 3.1.3-incubating to 5.0.0 Fixed in — No fix listed CNA
- org.apache.oozie:oozie-core (Maven) Vendor— Affected before 5.1.0 Fixed in 5.1.0 Patch available GHSA-wg5w-vv93-3f7w
Remediation
- Fix · GHSA-wg5w-vv93-3f7w org.apache.oozie:oozie-core (Maven) Fixed in 5.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11799
- 2026-10-03 Alias added: GHSA-wg5w-vv93-3f7w
References
Advisory 2
More Apache Oozie vulnerabilities
- TI-2017-11484 Path traversal in Apache Oozie CVSS 3.0MEDIUM 6.5
- TI-2025-19709 Apache Oozie: XSS in Oozie Web Console CVSS 3.1MEDIUM 5.4
- TI-2020-17980 Oozie local privilege escalation CVSS 3.1MEDIUM 4.7
Sources
- CVE-2018-11799 · CVE Program
- CVE-2018-11799 · NVD
- FIRST EPSS
- GHSA-wg5w-vv93-3f7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences