Quick answers
- Is CVE-2026-73219 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73219 being exploited in the wild.
- How severe is CVE-2026-73219?
- Informational severity, with a CVSS score of 0, published 11 August 2026.
- Which products and versions are affected?
- CVAT.ai CVAT 2.17.0 to 2.71.x.
- Is there a fix for CVE-2026-73219?
- A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73219 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-73219?
- Check whether you run CVAT.ai CVAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the RequestViewSet.create endpoint, which accepts batch automatic annotation requests without validating that the supplied task and job IDs are consistent (i.e., that the job belongs to the specified task). Since the task ID determines the single active request slot per task, an attacker with job write access can submit a request using another user's task ID paired with an accessible job ID. This blocks that task's automatic annotation slot, preventing legitimate requests for that task from being processed. The vulnerability affects CVAT versions 2.17.0 through 2.71.x; a similar check already existed for interactive requests but was missing for batch requests. The fix was merged in version 2.72.0 and adds validation to ensure task and job ID consistency before creating a batch request.
Affected products
- CVAT AI CVAT 2.17.0 to 2.71.x
Timeline
- 2026-08-11: disclosed
- 2026-07-29: patched