Executive brief
Frigate, an open-source network video recorder, allowed authenticated users with limited "viewer" permissions to access internal APIs they should not reach, potentially exposing sensitive data. An attacker with viewer credentials could extract camera configuration details, stream URLs containing credentials, application logs, and internal system information by querying specific endpoints. This vulnerability was patched in version 0.18.0 by removing the direct API proxy.
Technical details
The vulnerability exists in the nginx configuration which enforces authentication but fails to properly restrict role-based access to the /api/go2rtc/api endpoint prefix. While GET requests from viewer-role users are technically authenticated, they bypass administrator-level authorization checks, allowing access to the proxied go2rtc API endpoints (streams, config, log, stack). An authenticated viewer can extract camera credentials, internal paths, logs, and goroutine stack traces; non-GET methods remain blocked by limit_except directive.
Affected products
- Frigate Frigate before 0.18.0
Timeline
- 2026-09-22: disclosed
- 2026-04-02: patched: Fix merged in PR #22735, released in version 0.18.0