CVE-2026-33126
SSRF Vulnerability in Frigate /ffprobe Endpoint Allows Internal Access
Publication date: 2026-03-20
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frigate | frigate | to 0.16.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33126 is a Server-Side Request Forgery (SSRF) vulnerability found in the Frigate network video recorder software, specifically in the /ffprobe endpoint. This endpoint accepts user-controlled URLs without proper validation, allowing an attacker to make the Frigate server send HTTP requests to internal network resources or cloud metadata services.
An attacker with low privileges can exploit this flaw by sending a specially crafted request to the /api/ffprobe endpoint with a URL they control. The server then makes a request to that URL, which can be used to access internal hosts, perform port scanning, or bypass firewall restrictions.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to gather information about your internal network and services that are not normally accessible externally.
- Information disclosure through identification of internal hosts and services.
- Bypassing firewall restrictions to access internal services.
- Performing port scans on internal network hosts to enumerate open ports and services.
While the vulnerability does not directly impact confidentiality or availability, it does have a low impact on integrity and can be used as a stepping stone for further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the /ffprobe endpoint of the Frigate server to see if it accepts arbitrary URLs without proper validation.'}, {'type': 'paragraph', 'content': 'A proof of concept involves sending a request to the /api/ffprobe endpoint with a URL controlled by the tester (for example, a Burp Collaborator URL) and observing if the server makes a request to that URL, indicating SSRF capability.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -v "https://<frigate-server>/api/ffprobe?paths=http://<your-collaborator-url>"'}, {'type': 'paragraph', 'content': 'If the server makes a request to the supplied URL, it confirms the presence of the SSRF vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Upgrade the Frigate software to version 0.16.3 or later, where the vulnerability has been patched.'}, {'type': 'list_item', 'content': "Implement strict validation of the 'paths' argument in the /ffprobe endpoint to only allow camera stream protocols and block access to internal resources."}, {'type': 'list_item', 'content': 'Restrict access to the /ffprobe endpoint to authenticated admin users by adding role-based access controls.'}, {'type': 'list_item', 'content': 'Implement rate limiting on the endpoint to prevent abuse and reduce the risk of port scanning or other malicious activities.'}] [1]