CVE-2026-75608
highFrigate is an open source network video recorder.
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/blakeblackshear/frigate/commit/520d9eeb7f0fe46021f29fb8169741dd1d429271 security-advisories@github.com
- https://github.com/blakeblackshear/frigate/pull/22735 security-advisories@github.com
- https://github.com/blakeblackshear/frigate/releases/tag/v0.18.0 security-advisories@github.com
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr security-advisories@github.com
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr 134c704f-9b21-4f2e-91b3-4a467353bcc0