CVE-2026-33469 Details
Description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through `/api/config/raw`. This exposes sensitive values that are intentionally redacted from `/api/config`, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in `config.yml`. This appears to be a broken access control issue introduced by the admin-by-default API refactor: `/api/config/raw_paths` is admin-only, but `/api/config/raw` is still accessible to any authenticated user. Version 0.17.1 contains a patch.
A broken access control vulnerability has been identified in Frigate, a network video recorder, in version 0.17.0. This issue allows authenticated non-admin users to access the full raw Frigate configuration through the '/api/config/raw' endpoint. The raw configuration includes sensitive information such as camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and other secrets stored in 'config.yml'. The vulnerability was introduced by an admin-by-default API refactor, which mistakenly left '/api/config/raw' accessible to low-privilege authenticated users while restricting similar endpoints to admin users only.
Users are advised to update to Frigate version 0.17.1 or later, where this vulnerability has been patched. In version 0.17.1, the '/api/config/raw' endpoint has been restricted to admin users only.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frigate frigate | 0.17.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |