Frigate has SSRF vulnerability in /ffprobe endpoint
Priority MEDIUM 56CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed frigate (blakeblackshear): 0.16.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| blakeblackshear | frigate | before 0.16.3 | 0.16.3 | Patch available | CNA |
- frigate Vendorblakeblackshear Affected before 0.16.3 Fixed in 0.16.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* | before 0.16.3 | Vulnerable | blakeblackshear |
- cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* Versions before 0.16.3 Vulnerable ·blakeblackshear
Remediation
- Fix · CNA frigate (blakeblackshear) Fixed in 0.16.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33126
References
More blakeblackshear Frigate vulnerabilities
- TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
- TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
- TI-2026-25866 Missing authorization in blakeblackshear frigate CVSS 3.1MEDIUM 6.5
- TI-2026-25865 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw CVSS 3.1MEDIUM 6.5
- TI-2026-25556 Frigate has insecure password change functionality CVSS 4.0HIGH 8.6
- TI-2023-24471 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences