Read the docs
TI-2026-52912 Aliases CVE-2026-75608

Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Priority HIGH 67CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Fixed frigate (blakeblackshear): 0.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blakeblackshearfrigatebefore 0.18.00.18.0Patch availableCNA
  • frigate Vendorblakeblackshear Affected before 0.18.0 Fixed in 0.18.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*——blakeblackshear
  • cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* Versions — — ·blakeblackshear

Remediation

  • Fix · CNA frigate (blakeblackshear) Fixed in 0.18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75608

References

Other 4

  • TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
  • TI-2026-39479 Frigate viewer can read logs exposing admin and camera credentials CVSS 3.1HIGH 8.1
  • TI-2026-52911 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations CVSS 3.1HIGH 8.1
  • TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
  • TI-2025-38649 Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter CVSS 3.1HIGH 7.7
  • TI-2026-25866 Missing authorization in blakeblackshear frigate CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences