CVE-2026-33126: Frigate has SSRF vulnerability in /ffprobe endpoint
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33126?
CVE-2026-33126 has a high severity rating due to the potential for Server-Side Request Forgery (SSRF) attacks.
How do I fix CVE-2026-33126?
To fix CVE-2026-33126, upgrade to Frigate version 0.16.3 or later.
What does CVE-2026-33126 affect?
CVE-2026-33126 affects Frigate versions prior to 0.16.3, specifically targeting the /ffprobe endpoint.
What can attackers achieve with CVE-2026-33126?
Attackers can exploit CVE-2026-33126 to perform SSRF, allowing them to access internal services or sensitive data.
What is the nature of the vulnerability in CVE-2026-33126?
CVE-2026-33126 is an SSRF vulnerability that occurs due to the lack of validation for user-controlled URLs in the /ffprobe endpoint.