CVE-2026-73219
Received Received - Intake

Arbitrary Task Blocking in CVAT via Inconsistent Job IDs

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73219
EUVD
EUVD-2026-56843

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
opencv cvat From 2.17.0 (inc) to 2.72.0 (inc)
opencv cvat 2.72.0
cvat_ai cvat From 2.17.0 (inc) to 2.71.0 (inc)
cvat_ai cvat 2.72.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1288 The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73219 is a vulnerability in CVAT versions 2.17.0 through 2.71.0 where a user with write access to a job can block automatic annotation for a task by submitting inconsistent job and task IDs in a batch request. This causes a denial of service by preventing other users from running automatic annotation on the affected task.

Impact Analysis

This vulnerability allows an attacker to disrupt automatic annotation services for tasks they do not own by exploiting predictable request IDs. It primarily impacts system availability, causing delays or interruptions in annotation workflows. The attack can be executed remotely without physical access.

Mitigation Strategies

Upgrade CVAT to version 2.72.0 or later to address the vulnerability. Ensure stricter authorization rules are enforced for lambda function requests and validate consistency between job and task IDs in batch automatic annotation requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart