Executive brief
Frigate is an open-source network video recorder that monitors and records from IP cameras. Prior to version 0.17.2, an authenticated user with viewer-level permissions could send administrative commands via WebSocket to restart the service, disable motion detection, stop recordings, or modify camera settings. An attacker would need valid viewer credentials and network access to the Frigate server, but could cause service disruptions or disable security monitoring functions.
Technical details
The WebSocket handler in frigate/comms/ws.py failed to enforce role-based authorization on incoming message topics, relying only on nginx authentication without checking user roles. An authenticated viewer could send admin-only topics (restart, notifications/set, camera detection/recording/snapshot/audio/motion/enablement settings) to the dispatcher. The vulnerability requires valid authentication credentials and network access; a fix was implemented in version 0.17.2 by adding role-based checks to restrict non-admin users to read-only state queries.
Affected products
- blakeblackshear Frigate prior to 0.17.2
Timeline
- 2026-09-22: disclosed
- 2026-03-31: patched