CVE-2026-75608 Details
Description
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.
A broken access control vulnerability has been identified in Frigate Network Video Recorder (NVR) versions prior to 0.18.0. The issue arises in the nginx configuration, where the go2rtc internal API is proxied without proper authorization checks. This allows authenticated users with viewer roles to access sensitive information through various go2rtc API endpoints. The vulnerability exposes internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials.
Users are advised to update Frigate NVR to version 0.18.0 or later, where this vulnerability has been fixed. For those unable to update, the go2rtc API proxy can be modified to restrict access to admin users only or to filter the exposed endpoints to only those necessary for non-admin users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/blakeblackshear/frigate/commit/520d9eeb7f0fe46021f29fb8169741dd1d429271 | [email protected] | Source CodeVendor |
| https://github.com/blakeblackshear/frigate/pull/22735 | [email protected] | Issue TrackingVendor |
| https://github.com/blakeblackshear/frigate/releases/tag/v0.18.0 | [email protected] | Release NotesVendor |
| https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frigate | 0.17.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | New CVE Received | [email protected] |