Skip to content
Blakeblackshear Frigate vulnerabilities
-
blakeblackshear frigate
Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
CVE-2026-75608
7.7 High
-
blakeblackshear frigate
Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
CVE-2026-75607
8.1 High
-
blakeblackshear frigate
Frigate viewer can read logs exposing admin and camera credentials
CVE-2026-54652
8.1 High
-
blakeblackshear frigate
Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp
CVE-2026-33470
6.5 Medium
-
blakeblackshear frigate
Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw
CVE-2026-33469
6.5 Medium
-
blakeblackshear frigate
Frigate has SSRF vulnerability in /ffprobe endpoint
CVE-2026-33126
5.0 Medium
-
blakeblackshear frigate
Frigate has insecure password change functionality
CVE-2026-33124
8.6 High
-
blakeblackshear frigate
Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts
CVE-2026-33125
Fix available
7.1 High
-
blakeblackshear frigate
Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
CVE-2026-25643
Public exploit
9.1 Critical
-
blakeblackshear frigate
Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter
CVE-2025-62382
7.7 High
-
blakeblackshear frigate
In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
CVE-2024-32874
Fix available
6.8 Medium
-
blakeblackshear frigate
Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`
CVE-2023-45672
7.5 High
-
blakeblackshear frigate
Frigate reflected XSS through `/<camera_name>` API endpoints
CVE-2023-45671
4.7 Medium
-
blakeblackshear frigate
Frigate cross-site request forgery in `config_save` and `config_set` request handlers
CVE-2023-45670
7.5 High