CVE-2022-31188: CVAT annotation tool vulnerable to unauthenticated SSRF

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and a public exploit reference make this a high-urgency fix despite no KEV listing.

What it is

CVAT versions before 2.0.0 do not validate URLs used in an affected code path, allowing server-side request forgery. An attacker can make the CVAT server issue requests to arbitrary URLs, which matters because the server often sits inside a trusted network with access to internal services.

Impact

An attacker gains the ability to send requests from the CVAT server to internal or external systems, potentially reaching internal services, cloud metadata endpoints, or other resources not otherwise exposed. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not name the exact endpoint or parameter, so the precise request path is not specified in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.486 (98.8th percentile), and a public exploit reference exists on Packet Storm. No ransomware usage is documented.

What to do

• Upgrade CVAT to version 2.0.0 or later, which adds URL validation in the affected code path.
• If immediate upgrade is not possible, restrict outbound network access from the CVAT server to only required destinations.
• Block access from CVAT hosts to cloud instance metadata endpoints and internal management interfaces.
• Place CVAT behind authentication and network controls so it is not reachable by untrusted clients.
• Monitor for vendor guidance, since the record states there are no known workarounds.

Detection

• Review CVAT server logs for outbound requests to unusual or internal-only hosts and IP addresses.
• Alert on requests from CVAT hosts to link-local or metadata addresses such as 169.254.169.254.
• Baseline normal outbound destinations for the CVAT server and flag deviations.
• Correlate CVAT process activity with network connections to non-approved internal services.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.