CVE-2026-73219 PUBLISHED

CVAT: Denial of service with regards to automatic annotation

Assigner: GitHub_M
Reserved: 11.08.2026 Published: 11.08.2026 Updated: 11.08.2026

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor cvat-ai
Product cvat
Versions
  • Version >= 2.17.0, < 2.72.0 is affected

References

Problem Types

  • CWE-1288: Improper Validation of Consistency within Input CWE