Executive brief
Frigate, an open-source network video recorder, contains a security flaw that allows users with low-level 'viewer' permissions to access sensitive system logs. These logs may contain auto-generated administrator passwords and camera credentials. An attacker with basic access can use this information to take full control of the system and access private camera feeds.
Technical details
An incorrect authorization vulnerability exists in Frigate's log retrieval API. The 'GET /api/logs/{service}' endpoint is protected only by the 'allow_any_authenticated' dependency, which fails to restrict access to administrative users. Consequently, users with the 'viewer' role can download Frigate and nginx logs. These logs frequently contain sensitive information, such as auto-generated admin passwords printed during first boot and camera credentials (RTSP/ONVIF) captured in nginx access logs from GET query strings used during setup. An attacker can leverage this information to escalate privileges to administrator or compromise connected camera hardware. As of the advisory date, a fixed version has not been identified, though commits related to credential redaction have been observed.
Affected products
- blakeblackshear Frigate <= 0.17.1
Timeline
- 2026-06-28: advisory: GitHub Security Advisory GHSA-c4qf-xxq4-vf55 published
- 2026-07-08: disclosed: CVE-2026-54652 published to NVD