CVE-2026-73219 is a denial-of-service vulnerability in CVAT versions 2.17.0 through 2.72.0. The automatic annotation feature uses a single-slot lock keyed on task_id to prevent concurrent heavy operations on the same task. However, the RequestViewSet.create endpoint accepts both task_id and job_id parameters, but the slot validation only checks task_id. This mismatch means an attacker who can predict or enumerate task IDs can deterministically block automatic annotation for any target task by submitting a competing request—regardless of what job_id is passed. The vulnerability was patched in version 2.72.0.
The CVSS 5.3 score understates the operational impact. CVAT typically sits at the input of ML training pipelines, and blocking automatic annotation can starve downstream model retraining cycles that run on fixed schedules. If your CVAT deployment serves cross-organizational users where job and task IDs can be observed or inferred across projects, the enumeration barrier is lower than the CVE assumes.
Immediate actions: confirm you are on 2.72.0 or later. Then determine whether the fix removed the job_id parameter entirely or added consistency validation between job_id and task_id—monitoring API behavior post-patch can reveal which approach was taken. Finally, audit your CVAT deployment for other implicit task_id-based assumptions in the annotation pipeline. This vulnerability pattern—operational resource locking used as an implicit authorization boundary—has recurred across job schedulers and pipeline tools for decades; CVAT is unlikely to be an exception to further similar gaps.