CVE-2025-26796: Apache Oozie XSS Vulnerability

CVE-2025-26796 Overview

CVE-2025-26796 is a Cross-Site Scripting (XSS) vulnerability affecting Apache Oozie, a workflow scheduler system for managing Apache Hadoop jobs. The flaw stems from improper neutralization of input during web page generation [CWE-79]. All versions of Apache Oozie are affected. The project is retired, and the Apache Software Foundation has stated no fix will be released. Users must migrate to an alternative or restrict access to trusted users only.

Critical Impact
An authenticated attacker can inject malicious scripts that execute in another user's browser session, enabling session hijacking, credential theft, or unauthorized actions within the Oozie web console. No patch will be issued because the project is end-of-life.

Affected Products

Apache Oozie (all versions)
Hadoop environments integrating Oozie for workflow scheduling
Deployments exposing the Oozie web console to untrusted users

Discovery Timeline

2025-03-22 - CVE-2025-26796 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26796

Vulnerability Analysis

Apache Oozie fails to properly sanitize user-supplied input before rendering it in web pages served by the Oozie console. Attackers with low-level privileges can inject JavaScript payloads that execute in the browser of any user viewing the affected page. The scope change indicates the injected script executes in a security context beyond the vulnerable component, likely affecting adjacent web resources. Because Apache Oozie has been retired, the maintainers have declared no security patch will be issued for this defect.

Root Cause

The root cause is missing or insufficient output encoding when reflecting user-controlled data into HTML responses generated by the Oozie web interface. Fields associated with workflow jobs, coordinator submissions, or user-supplied parameters can carry payloads that the server writes into rendered pages without contextual escaping. This maps directly to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the Oozie web console and low privileges to submit workflow content. The attack also requires user interaction, meaning a victim must load the malicious page or view an attacker-crafted workflow record. Once triggered, the injected script runs with the victim's session in the Oozie console, permitting theft of authentication cookies, forged administrative actions, or pivoting to backend Hadoop services.

No verified public exploit code is available. See the Apache Mailing List Discussion and the Openwall OSS Security Update for maintainer commentary.

Detection Methods for CVE-2025-26796

Indicators of Compromise

Workflow definitions, coordinator jobs, or bundle submissions containing HTML tags such as <script>, onerror=, onload=, or javascript: URIs
Unexpected outbound requests from browsers of Oozie console users to attacker-controlled domains
Anomalous session activity or privilege changes originating from Oozie administrator accounts

Detection Strategies

Inspect HTTP request bodies and query strings sent to the Oozie web console for encoded or raw script payloads
Review Oozie audit logs for workflow submissions containing suspicious characters in job names, parameters, or configuration values
Correlate browser telemetry with Oozie console access to identify script execution originating from Oozie-hosted pages

Monitoring Recommendations

Deploy a web application firewall in front of the Oozie console with XSS signature rules enabled
Enable verbose request logging on the Oozie HTTP endpoint and forward logs to a centralized SIEM for retention and analysis
Alert on any workflow submission where field values contain HTML control characters or JavaScript keywords

How to Mitigate CVE-2025-26796

Immediate Actions Required

Restrict network access to the Oozie web console using firewall rules, VPN gating, or reverse-proxy authentication
Limit Oozie user accounts to trusted operators and remove anonymous or shared credentials
Plan migration to a supported workflow orchestration platform such as Apache Airflow, since Oozie is retired

Patch Information

No patch will be released. The Apache Software Foundation has retired the Oozie project and explicitly stated no fixed version addressing CVE-2025-26796 is planned. Organizations must treat all Oozie deployments as permanently vulnerable and rely on compensating controls or migration.

Workarounds

Place the Oozie console behind an authenticating reverse proxy that enforces strict Content Security Policy (CSP) headers
Disable public network exposure and require SSO or mutual TLS for console access
Deploy a WAF rule set that blocks HTML and JavaScript payloads in POST bodies submitted to Oozie endpoints
Decommission Oozie instances that are no longer actively used

bash

# Example: restrict Oozie console access with iptables to a trusted subnet
iptables -A INPUT -p tcp --dport 11000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 11000 -j DROP

# Example: nginx reverse proxy enforcing CSP and IP allowlist
# server {
#     listen 443 ssl;
#     server_name oozie.internal.example.com;
#     allow 10.0.0.0/24;
#     deny all;
#     add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
#     location / {
#         proxy_pass http://oozie-backend:11000;
#     }
# }