High severity · published Sep 22, 2026
CVE-2026-75608
Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
frigate · blakeblackshear
< 0.18.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75608
x_refsource_CONFIRM
https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr
x_refsource_MISC
https://github.com/blakeblackshear/frigate/pull/22735
x_refsource_MISC
https://github.com/blakeblackshear/frigate/commit/520d9eeb7f0fe46021f29fb8169741dd1d429271
x_refsource_MISC
https://github.com/blakeblackshear/frigate/releases/tag/v0.18.0
More from frigate
9.1
CVE-2026-25643
Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
8.8
CVE-2026-33124
Frigate has insecure password change functionality
8.1
CVE-2026-75607
Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
8.1
CVE-2026-54652
Frigate viewer can read logs exposing admin and camera credentials
8.1
CVE-2026-33125
Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts