CVE-2026-33469: Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through /api/config/raw. This exposes sensitive values that are intentionally redacted from /api/config, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in config.yml. This appears to be a broken access control issue introduced by the admin-by-default API refactor: /api/config/rawpaths is admin-only, but /api/config/raw is still accessible to any authenticated user. Version 0.17.1 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33469?
The severity of CVE-2026-33469 is classified as medium, as it allows authenticated non-admin users to access sensitive configuration data.
How do I fix CVE-2026-33469?
To fix CVE-2026-33469, upgrade Frigate to a version later than 0.17.0 where this vulnerability has been addressed.
Who is affected by CVE-2026-33469?
CVE-2026-33469 affects users of Frigate version 0.17.0, specifically those who have authenticated but are not assigned admin privileges.
What is the impact of CVE-2026-33469?
The impact of CVE-2026-33469 is that it exposes sensitive configuration details to non-admin users, which could lead to unauthorized access or misuse of the system.
Can CVE-2026-33469 be exploited remotely?
CVE-2026-33469 cannot be exploited remotely, as it requires authenticated access to the API by a non-admin user.