CVE-2025-26796: Apache Oozie XSS Vulnerability in All Versions
Summary
CVE-2025-26796: Apache Oozie Cross-Site Scripting (XSS). Affects org.apache.oozie:oozie-core versions < 5.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Oozie is a workflow scheduler system to manage Hadoop jobs. It allows users to define complex workflows and manage job execution in a distributed environment. However, all versions of Apache Oozie are affected by a Cross-Site Scripting (XSS) vulnerability, which can lead to security risks if exploited.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by users. This could lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking. The issue is classified under CWE-79, indicating a serious risk to user data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, restrict access to the Oozie instance to trusted users only. This can be achieved by implementing network security measures such as firewalls or VPNs to limit exposure.
Conclusion
The Apache Oozie XSS vulnerability (CVE-2025-26796) poses a significant risk due to improper input handling. With no available patch, users must take immediate action to secure their instances by restricting access or migrating to alternative solutions.
See every vulnerability recorded for org.apache.oozie:oozie-core →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
All versions of Apache Oozie are affected by this vulnerability.
No, there is no patch available as Apache Oozie is a retired project.
It is recommended to find an alternative solution or restrict access to the Oozie instance to trusted users.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.oozie:oozie-core.
