CVE-2026-75607 in Frigate
Summary
by MITRE • 09/22/2026
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Frigate serves as a popular open-source network video recorder designed to provide real-time object detection for IP cameras, leveraging machine learning models to identify people, vehicles, and other objects within video feeds. The software architecture relies on an Nginx reverse proxy to handle incoming HTTP requests and WebSocket connections from client applications. In versions prior to 0.17.2, a critical architectural flaw exists in the authentication and authorization flow between Nginx and the Python-based backend application that processes these connections. Specifically, while Nginx is configured to enforce basic or digest authentication for certain endpoints, it does not pass role-specific metadata regarding the authenticated user's privileges to the underlying WebSocket handler located in frigate/comms/ws.py. This gap creates a situation where the application layer assumes all connected users possess equivalent permissions if they have successfully passed the initial Nginx authentication check, regardless of their assigned role within the Frigate system.
The technical flaw centers on the lack of role-aware authorization checks during WebSocket message dispatching. When an authenticated user establishes a WebSocket connection to manage camera settings or trigger actions such as restarting services, changing detection parameters, or modifying recording configurations, the backend handler accepts these commands without verifying if the specific action is permitted for that user's privilege level. Because Nginx does not provide role information via headers or environment variables to the Python application, the developer of the WebSocket handler failed to implement a secondary verification step within the application logic. Consequently, any user with valid viewer credentials can interact with administrative endpoints and execute commands intended exclusively for administrators. This bypasses the principle of least privilege by allowing lower-privileged entities to perform high-level system modifications.
The operational impact of this vulnerability is severe due to its potential to disrupt security operations and compromise system integrity. An attacker possessing only viewer access rights can send malicious messages over WebSocket connections to trigger administrative functions such as restarting the Frigate service, which causes a temporary outage in video recording and monitoring capabilities. Furthermore, attackers can disable critical security features including motion detection, object detection algorithms, snapshot generation, audio processing, and camera enablement settings. By disabling these functions, an attacker effectively blinds the surveillance system, allowing unauthorized physical access or activity to go undetected for extended periods. Additionally, the ability to restart services repeatedly could lead to denial of service conditions through resource exhaustion if exploited in a loop, further degrading the reliability of the security infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it allows an actor to elevate their privileges beyond what is intended by the system design. It also relates to CWE-862, Missing Authorization, because the application fails to enforce access control policies on specific resources or actions based on user roles. From a tactical perspective within the MITRE ATT&CK framework, this flaw facilitates lateral movement and impact categories such as Service Stop (T1499) and Defense Evasion (T1562), specifically through disabling security tools like T1562.001 which involves impairing defenses by disabling or modifying logging capabilities or monitoring systems. The vulnerability underscores the importance of ensuring that authentication mechanisms at reverse proxies are complemented by robust authorization checks within the application layer, particularly when dealing with administrative functions in network-connected devices.
To mitigate this risk, organizations running Frigate must immediately upgrade to version 0.17.2 or later, where the WebSocket handler has been patched to include proper role-based access control checks before processing messages. Until an upgrade is feasible, administrators should consider restricting direct exposure of WebSocket endpoints if possible and ensuring that viewer accounts are assigned only to users who do not require any administrative interaction with the system. Regular audits of user roles and permissions within Frigate can help minimize the blast radius in case of future vulnerabilities. Additionally, implementing network segmentation to isolate video recording infrastructure from general corporate networks adds a layer of defense-in-depth, limiting an attacker's ability to reach these endpoints even if they compromise other systems on the same network segment.