CVE-2026-73221: CVAT Information Disclosure Vulnerability

CVE-2026-73221 Overview

CVAT (Computer Vision Annotation Tool) is an open source interactive video and image annotation platform for computer vision workflows. CVE-2026-73221 is an authorization flaw [CWE-863] affecting CVAT versions 2.17.0 through 2.71.x. A user holding the Worker role can leverage predictable task-based request IDs against the lambda request retrieve and destroy endpoints. This lets the attacker view automatic annotation requests for tasks or jobs they cannot access and cancel requests initiated by other users. The issue is fixed in version 2.72.0.

Critical Impact
Authenticated Worker-role users can enumerate and cancel automatic annotation lambda requests belonging to other users, leading to information disclosure and disruption of annotation workflows.

Affected Products

CVAT versions 2.17.0 through 2.71.x
CVAT lambda_manager application component
CVAT deployments exposing lambda request endpoints to Worker-role users

Discovery Timeline

2026-08-11 - CVE-2026-73221 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73221

Vulnerability Analysis

CVAT exposes lambda endpoints that manage automatic annotation requests running on serverless functions. The retrieve and destroy endpoints identify requests using a deterministic identifier derived from the target task or job. Because the identifier is predictable, any authenticated user can construct valid request IDs for tasks they do not own.

The permission logic in cvat/apps/lambda_manager/permissions.py and the corresponding Rego policy in cvat/apps/lambda_manager/rules/lambda.rego failed to reject Worker-role access to offline call scopes. The result is a broken authorization check that permits cross-tenant observation and cancellation of annotation jobs.

Root Cause

The root cause is improper authorization [CWE-863] in the lambda request handlers. The scope model included call:offline and list:offline values that bypassed the ownership checks enforced for interactive scopes. Combined with request IDs that can be reconstructed from task and job identifiers, this allowed a Worker to reference arbitrary requests without possessing access to the underlying resource.

Attack Vector

Exploitation requires network access and a valid account with the Worker role. The attacker enumerates task or job IDs visible or guessable within the organization, constructs the corresponding lambda request ID, and issues GET (retrieve) or DELETE (destroy) calls against the lambda request endpoint. Successful calls return the request state for other users' annotation jobs or terminate their in-flight automatic annotation work.

python

         LIST = "list"
         VIEW = "view"
         CALL_ONLINE = "call:online"
-        CALL_OFFLINE = "call:offline"
-        LIST_OFFLINE = "list:offline"
 
     @classmethod
     def create(cls, request, view, obj, iam_context):

Source: GitHub commit 20a1076

The patch removes the offline scopes that were used to bypass authorization. A matching Rego policy update narrows the accepted scope set:

text

 import rego.v1
 
 import data.utils
-import data.organizations
 
 # input: {
-#     "scope": <"list"|"view"|"call:online"|"call:offline"|"list:offline"> or null,
+#     "scope": <"list"|"view"|"call:online"> or null,
 #     "auth": {
 #         "user": {
 #             "id": <num>,

Source: GitHub commit 20a1076

Detection Methods for CVE-2026-73221

Indicators of Compromise

Worker-role accounts issuing GET or DELETE requests to /api/lambda/requests/<id> for tasks or jobs outside their assigned scope.
Unexpected cancellation of automatic annotation requests reported by task owners.
Sequential or scripted access patterns against lambda request IDs from a single authenticated session.

Detection Strategies

Correlate lambda request access logs against task/job ownership records to identify cross-user access.
Alert when a Worker-role account issues DELETE calls on lambda requests it did not create.
Baseline normal lambda request volumes per user and flag statistical outliers.

Monitoring Recommendations

Enable verbose audit logging on the CVAT lambda_manager application and ship logs to a central analytics platform.
Monitor authentication events for Worker-role accounts issuing high-frequency API calls.
Track HTTP 200 responses on retrieve endpoints where the requesting user lacks the corresponding task permission.

How to Mitigate CVE-2026-73221

Immediate Actions Required

Upgrade CVAT to version 2.72.0 or later on all deployments.
Audit Worker-role account activity against lambda request endpoints since 2.17.0 was deployed.
Rotate API tokens for any Worker accounts suspected of abuse.
Notify task and job owners whose automatic annotation requests may have been cancelled.

Patch Information

The fix is delivered in CVAT release v2.72.0 via pull request #10964 and commit 20a1076. Additional context is available in GitHub Security Advisory GHSA-m7p7-6w4m-886p.

Workarounds

Restrict Worker-role assignments to trusted users until the upgrade is applied.
Place CVAT behind an authenticating reverse proxy that filters access to /api/lambda/requests/ for non-privileged roles.
Temporarily disable serverless automatic annotation features if upgrading is not immediately feasible.

bash

# Upgrade CVAT to the fixed release
git fetch --tags
git checkout v2.72.0
docker compose pull
docker compose up -d

# Verify the running version
docker compose exec cvat_server python manage.py --version