CVE-2026-54652
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Frigate 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user, including the viewer role, to download Frigate and nginx logs. These logs may expose auto-generated admin passwords and camera credentials, enabling viewer-to-admin privilege escalation.
Risk Assessment
The organization risks exposure of sensitive credentials (admin and camera passwords) and unauthorized full control over the surveillance system by a low-privileged user.
Recommendation
Immediately restrict access to the /api/logs/{service} endpoint to administrators only, and consider temporarily disabling this endpoint until an official patch is released.
Other vulnerabilities in Frigate
See all- CVE-2026-75607High
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. This issue is fixed in version 0.17.2.
- CVE-2026-75608High
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. This issue is fixed in version 0.18.0.
Original NVD description (English source)
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS