CVE-2026-75607
HighCVSS 8.1Summary
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. This issue is fixed in version 0.17.2.
Risk Assessment
A low-privileged user can trigger service restarts or disable security monitoring functions, leading to operational disruption and weakened protection. Authentication must be enabled and valid viewer credentials are required.
Recommendation
Upgrade Frigate to version 0.17.2 or later. Ensure authentication is enabled and restrict viewer accounts to the minimum necessary permissions.
Other vulnerabilities in Frigate
See all- CVE-2026-75608High
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. This issue is fixed in version 0.18.0.
- CVE-2026-54652High
In Frigate 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user, including the viewer role, to download Frigate and nginx logs. These logs may expose auto-generated admin passwords and camera credentials, enabling viewer-to-admin privilege escalation.
Original NVD description (English source)
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.