---
id: CVE-2026-75608
title: Frigate is an open source network video recorder
summary: >-
  Frigate is an open source network video recorder. Prior to 0.18.0, the
  prefix-matched location /api/go2rtc/api in
  docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but
  does not require an administrator role for G…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-863
vendor: blakeblackshear
product: frigate
affected:
  - frigate < 0.18.0
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:17:54.727'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75608'
references:
  - url: >-
      https://github.com/blakeblackshear/frigate/commit/520d9eeb7f0fe46021f29fb8169741dd1d429271
    label: security-advisories@github.com
  - url: 'https://github.com/blakeblackshear/frigate/pull/22735'
    label: security-advisories@github.com
  - url: 'https://github.com/blakeblackshear/frigate/releases/tag/v0.18.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-22T16:06:00.489Z'
epss: 0.00511
epssPercentile: 0.4261
---

## Overview

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.