CVE-2026-75608
Deferred Deferred - Pending Action

Authentication Bypass in Frigate NVR

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-75608
EUVD
EUVD-2026-84531

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
blakeblackshear frigate to 0.18.0 (exc)
blakeblackshear frigate 0.18.0
frigate frigate to 0.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75608 is a vulnerability in Frigate NVR version 0.17.1 where an authenticated viewer user can access the go2rtc internal API through a misconfigured nginx proxy. The proxy uses prefix matching for /api/go2rtc/api but only requires authentication, not admin privileges, allowing GET requests to expose sensitive data like internal addresses, configuration paths, logs, and RTSP stream URLs with credentials.

Detection Guidance

Check nginx logs for requests to /api/go2rtc/api from non-admin users. Inspect Frigate API access logs for unusual GET requests to internal endpoints. Verify if viewer-role users can access configuration, logs, or stream data via the go2rtc proxy.

Impact Analysis

An attacker with viewer credentials could access internal network details, configuration files, application logs, and RTSP stream URLs containing camera credentials. This enables internal reconnaissance, potential credential reuse for lateral movement, and exposure of sensitive system information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data (e.g., camera feeds with credentials), violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Exposure of internal logs and configurations may also breach compliance requirements for data security and access controls.

Mitigation Strategies

Upgrade Frigate to version 0.18.0 or later. If upgrading is not possible, restrict access to /api/go2rtc/api by modifying nginx configuration to enforce admin-only access. Remove the direct go2rtc API proxy from nginx.conf.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart