CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood

Sat, 07 Feb 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2108%20-%20COCO%20Annotator%20-%20Unauthenticated%20Denial%20of%20Service%20via%20Task%20Queue%20Flood
📋 CVE record: CVE-2026-2108

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/info/long_task`
Vulnerability Type	CWE-306: Missing Authentication for Critical Function; CWE-400: Uncontrolled Resource Consumption
CVE ID	CVE-2026-2108

Vulnerability Summary

The endpoint /api/info/long_task is exposed without authentication or rate limiting, and allows any remote user to enqueue Celery background tasks and write entries to the database (TaskModel) on every request.

DoS on Natan Maia Morette

CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood

Advisory Information

Vulnerability Summary