CVE-2026-75608: Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limitexcept GET. This issue is fixed in version 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frigateto a version that resolves this vulnerability.Fixed in 0.18.0
Event History
Frequently Asked Questions
Which deployments are affected?
Frigate versions prior to 0.18.0 are affected. The exposed route is protected by authentication, but viewer-role accounts can access it through GET requests without administrator privileges.
What does an attacker need to exploit this issue?
An attacker needs valid credentials for a Frigate account assigned the viewer role. No user interaction is required, and the attacker can access the vulnerable endpoint over the network.
What information can a viewer-role user obtain?
They can request the proxied go2rtc streams, config, log, and stack endpoints. The returned data may disclose internal addresses, configuration paths, logs, goroutine stack data, and RTSP URLs that can contain camera credentials.
Can the exposed go2rtc API be modified through this flaw?
No. Non-GET methods remain blocked by the nginx limit_except GET configuration, so the described exposure is limited to reading information.
What is the remediation?
Upgrade Frigate to version 0.18.0, which fixes the authorization issue.