CVE-2026-75608: high-severity vulnerability in blakeblackshear frigate
Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.4%
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
blakeblackshear · frigateRelated CVEs — blakeblackshear frigate
In the same product, most dangerous first.
CVE-2026-25643CRITICALFrigate Affected by Authenticated Remote Command Execution (RCE) and Container EscapeEPSS 3.0%CVE-2023-45672HIGHFrigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`EPSS 1.6%CVE-2023-45671MEDIUMFrigate reflected XSS through `/<camera_name>` API endpointsEPSS 1.4%CVE-2024-32874MEDIUMIn Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of ServiceEPSS 0.8%CVE-2026-75607HIGHFrigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only OperationsEPSS 0.6%CVE-2023-45670HIGHFrigate cross-site request forgery in `config_save` and `config_set` request handlersEPSS 0.5%