CVE-2026-75608 in Frigate
Summary
by MITRE • 09/22/2026
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Frigate versions prior to 0.18.0 represents a significant authorization bypass within the application's web server configuration, specifically affecting the integration with the go2rtc API service. Frigate operates as an open-source network video recorder that relies on nginx for handling HTTP requests and routing traffic between its various components. The core technical flaw lies in the access control rules defined in the nginx configuration file located at docker/main/rootfs/usr/local/nginx/conf/nginx.conf. While the system correctly implements authentication requirements to prevent unauthenticated users from accessing sensitive endpoints, it fails to enforce role-based restrictions on specific HTTP methods for a critical sub-path. Specifically, the location block prefixed with /api/go2rtc/api requires user authentication but does not restrict access based on administrative privileges when processing GET requests. This misconfiguration allows any authenticated user, regardless of their assigned role or permission level, to interact with this endpoint without being elevated to an administrator status.
The operational impact of this vulnerability is severe due to the sensitive nature of the data exposed through the go2rtc API. An attacker who has obtained valid credentials for a viewer account can exploit this flaw by sending GET requests to various subpaths under /api/go2rtc/api, including streams, config, log, and stack endpoints. Accessing the streams endpoint allows the retrieval of RTSP stream URLs, which may contain embedded camera credentials such as usernames and passwords in plain text or encoded formats depending on the camera configuration. The config endpoint exposes internal system configurations and paths that can aid further reconnaissance efforts. Furthermore, access to the log endpoint reveals application logs containing potentially sensitive operational data, while the stack endpoint provides goroutine stack traces from the Go runtime environment. These stack dumps often contain detailed information about memory addresses, variable values, and execution contexts, which can be leveraged by attackers for debugging-based attacks or further exploitation of underlying infrastructure vulnerabilities.
This vulnerability aligns with CWE-269, Improper Privilege Assignment, as it involves a failure to enforce the principle of least privilege by allowing lower-level users to perform actions reserved for administrators. Additionally, from an offensive security perspective, this behavior is consistent with ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to access resources they should not have permission to view. The restriction on non-GET methods via the limit_except directive indicates that the developers intended to allow read-only access for viewers but inadvertently failed to apply role-based filtering to these read operations. This oversight creates a direct path for information disclosure and potential credential theft, compromising the confidentiality of both the surveillance system's internal architecture and the connected camera devices.
To mitigate this vulnerability, organizations running Frigate must upgrade immediately to version 0.18.0 or later, where the access control logic has been corrected to enforce proper role-based restrictions on all relevant endpoints within the go2rtc API proxy. For environments that cannot yet patch due to dependency constraints, manual modification of the nginx configuration file is required. Administrators should review the location block for /api/go2rtc/api and ensure that authentication checks are coupled with authorization checks that verify user roles before allowing GET requests. Implementing strict role-based access control at the application layer rather than relying solely on web server configurations can also provide defense in depth. Regular auditing of nginx configuration files against security best practices is recommended to prevent similar misconfigurations in other services or future updates, ensuring that authentication and authorization mechanisms are consistently applied across all exposed interfaces.