CVE-2026-73219: CVAT Denial of Service Vulnerability

CVE-2026-73219 Overview

CVE-2026-73219 affects Computer Vision Annotation Tool (CVAT), an open-source interactive video and image annotation platform for computer vision workflows. The vulnerability exists in versions 2.17.0 through 2.71.x and is fixed in version 2.72.0. A user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job identifiers. Because the task ID determines the single active request slot, an attacker can block automatic annotation for another task whose ID is known. The issue is classified as CWE-1288: Improper Validation of Consistency within Input.

Critical Impact
Authenticated users with job write access can deny automatic annotation service to other tasks by exploiting inconsistent task/job ID validation in the annotation request handler.

Affected Products

CVAT versions 2.17.0 through 2.71.x
Self-hosted CVAT deployments accepting authenticated annotation requests
CVAT SaaS instances prior to the 2.72.0 release

Discovery Timeline

2026-08-11 - CVE-2026-73219 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73219

Vulnerability Analysis

The flaw resides in CVAT's RequestViewSet.create endpoint, which handles batch automatic annotation submissions. CVAT enforces a single active automatic annotation request per task by keying the request slot on the task ID. However, the endpoint accepts both a task ID and a job ID without validating that the job belongs to the referenced task.

An authenticated user with write access to any job can craft a request that pairs their legitimate job ID with an arbitrary target task ID. The server accepts the mismatched payload and occupies the target task's request slot. This prevents legitimate users of the victim task from starting automatic annotation until the malicious slot is released.

The issue is a business logic flaw rather than a memory safety or injection defect. Confidentiality and integrity are not directly affected; the impact is limited to availability of the automatic annotation feature for the targeted task.

Root Cause

The root cause is missing consistency validation between related identifiers in the same request. RequestViewSet.create treated the task ID and job ID as independent parameters instead of verifying that the supplied job belongs to the supplied task. This aligns with CWE-1288, where security decisions are made using input that has not been validated for internal consistency.

Attack Vector

Exploitation requires network access to the CVAT API and low-privilege authentication with write access to at least one job. The attacker must know the numeric task ID of the victim task, which is often exposed in URLs and API responses to other project members. No user interaction is required from the victim.

python

# Patch fragment from cvat/apps/lambda_manager/permissions.py
         LIST = "list"
         VIEW = "view"
         CALL_ONLINE = "call:online"
-        CALL_OFFLINE = "call:offline"
-        LIST_OFFLINE = "list:offline"
 
     @classmethod
     def create(cls, request, view, obj, iam_context):
# Source: https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b121e40f16d66d373b3f7

The patch removes the offline call scopes that permitted the abused batch flow, alongside consistency validation added in the request handler. A companion change in cvat/apps/lambda_manager/rules/lambda.rego restricts the accepted scopes:

text

 import rego.v1
 
 import data.utils
-import data.organizations
 
 # input: {
-#     "scope": <"list"|"view"|"call:online"|"call:offline"|"list:offline"> or null,
+#     "scope": <"list"|"view"|"call:online"> or null,
# Source: https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b121e40f16d66d373b3f7

Detection Methods for CVE-2026-73219

Indicators of Compromise

POST requests to /api/requests where the referenced job ID does not belong to the referenced task ID
Repeated automatic annotation requests from a single user targeting task IDs outside their assigned projects
User complaints that automatic annotation appears stuck or unavailable on specific tasks

Detection Strategies

Enable verbose logging on RequestViewSet.create and cross-reference task_id and job_id fields against database ownership
Alert when the same authenticated principal submits batch annotation requests referencing tasks they do not own
Review Django audit logs for call:offline or list:offline scope usage prior to upgrading

Monitoring Recommendations

Track the queue depth and slot occupancy of the automatic annotation worker per task ID
Correlate CVAT application logs with reverse proxy access logs to attribute request slot occupation to specific accounts
Forward CVAT API logs to a centralized analytics platform to baseline normal annotation request patterns and flag anomalies

How to Mitigate CVE-2026-73219

Immediate Actions Required

Upgrade CVAT to version 2.72.0 or later, which contains the official fix from pull request #10964
Audit user accounts with job write access and revoke access from users who no longer require it
Review recent automatic annotation request activity for signs of abuse against high-value tasks

Patch Information

The fix ships in the CVAT v2.72.0 release. Full remediation details are documented in GitHub Security Advisory GHSA-7xhx-3q27-xvcx. The patch adds consistency validation between the task and job parameters and removes the deprecated offline lambda invocation scopes.

Workarounds

Restrict job write access to trusted users only until the upgrade to 2.72.0 is complete
Place CVAT behind an API gateway that inspects annotation request bodies and rejects payloads with mismatched task and job IDs
Temporarily disable automatic annotation features for untrusted tenants if immediate patching is not feasible

bash

# Verify the running CVAT version and upgrade via Docker Compose
docker exec cvat_server python manage.py --version
git checkout v2.72.0
docker compose pull
docker compose up -d