CVAT CVE-2026-73221

Exploitation requires an active CVAT account with at minimum the Worker role - unauthenticated access is not possible, as the CVSS 4.0 PR:L metric confirms. The attacker must be able to predict or enumerate task-based lambda request IDs; the advisory characterizes these IDs as predictable, implying they are derived from observable task identifiers rather than randomly generated. The lambda (automatic annotation) feature must be actively in use: if no lambda annotation requests have been submitted in the deployment, there is nothing to retrieve or cancel. Exploitation is scoped strictly to lambda request metadata visibility and request cancellation - it does not expose annotation data, task content, model weights, or any higher-privilege operations. Multi-tenant CVAT deployments where Worker accounts from different teams or organizations share the same instance represent the primary risk population; single-team or fully trusted-user deployments face minimal practical risk.

The CVSS 4.0 score of 5.3 (Medium) accurately represents the constrained blast radius: exploitation requires a valid Worker-role credential (PR:L), the confidentiality exposure is limited to lambda request metadata rather than annotation content (VC:L), and the integrity impact is limited to canceling others' annotation jobs (VI:L). SSVC corroborates this: exploitation is confirmed none, the attack is not automatable (no), and technical impact is partial - collectively placing this in a lower remediation priority tier than critical network-exposed flaws. No EPSS data was provided; the absence of KEV listing and no known POC support a low active-exploitation probability. The most meaningful real-world risk scenario is an insider or compromised Worker account in a multi-tenant CVAT deployment deliberately canceling annotation pipelines for other teams, causing workflow disruption disproportionate to the CVSS score. Single-team deployments where all Workers are fully trusted face negligible practical risk.

An authenticated CVAT user with the Worker role constructs or enumerates predictable task-based lambda request IDs - derived from task identifiers the Worker can observe from their own tasks - and issues GET requests to the lambda retrieve endpoint for IDs corresponding to tasks they have no legitimate access to, obtaining annotation request metadata. The attacker then issues DELETE requests to the destroy endpoint using those IDs to cancel in-flight automatic annotation jobs belonging to other teams, disrupting their annotation pipelines. No public exploit code has been identified at time of analysis.