Description

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-22T16:17:54.607Z",
  "pubdate": "2026-09-22T16:17:54.607Z",
  "executiveSummary": "Frigate versions prior to 0.18.0 are susceptible to an improper authorization vulnerability within the Nginx reverse proxy configuration. The vulnerability resides in the /api/go2rtc/api endpoint, which improperly validates user roles for GET requests.\nAlthough the endpoint requires a baseline authenticated session, it fails to enforce an administrator privilege check, allowing standard viewer-level users to access sensitive functionalities proxied to the underlying go2rtc API.\nAn authenticated attacker can leverage this misconfiguration to gain unauthorized access to internal application data and system configurations. The security risk is significant as it facilitates the exfiltration of sensitive information, including camera stream credentials, internal network topologies, and system execution states.\nSuccessful exploitation requires the attacker to possess at least a low-privileged viewer account. No specialized exploit code is required, as the vulnerability can be triggered via standard HTTP GET requests targeting the exposed subpaths.",
  "technicalDetails": "The vulnerability is located in the nginx.conf file, specifically within the directive managing the /api/go2rtc/api location prefix. The configuration fails to restrict access based on user authorization levels for HTTP GET requests. While the system correctly identifies and blocks non-GET methods via the limit_except directive, the GET method is improperly permitted for any authenticated user, regardless of their role.\nThe go2rtc API is a high-privilege interface designed to manage real-time video streaming, configuration, and internal diagnostics. By exposing this API to viewer-level accounts, the Nginx reverse proxy effectively bypasses the intended security boundaries of the Frigate application. Attackers can interact with various sensitive subpaths, such as /api/go2rtc/api/config, /api/go2rtc/api/log, and /api/go2rtc/api/stack.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the Frigate instance using a valid, low-privileged viewer account. 2) The attacker crafts an HTTP GET request directed at the /api/go2rtc/api/ path. 3) The Nginx proxy, failing to verify administrative rights, forwards the request to the go2rtc service. 4) The go2rtc service processes the request and returns sensitive data to the attacker.\nThe impact of this exploitation includes: 1) Information Disclosure: Access to the application configuration, which may contain sensitive environment variables or system paths. 2) Operational Intelligence: Retrieval of internal application logs and goroutine stack data, which can be utilized for reconnaissance or identifying further vulnerabilities. 3) Credential Theft: Exfiltration of RTSP stream URLs, which frequently contain embedded plaintext authentication credentials for connected cameras. 4) Network Reconnaissance: Identification of internal IP addresses and service configurations derived from the proxied API responses. The vulnerability affects all versions of Frigate prior to 0.18.0. The lack of granular access control at the proxy level allows for a privilege escalation from a viewer role to an observer capable of viewing deep system internals."
}