CVE-2026-25643: Frigate NVR Remote Code Execution Flaw

CVE-2026-25643 Overview

CVE-2026-25643 is a critical Remote Command Execution (RCE) vulnerability discovered in Frigate, a popular network video recorder (NVR) solution featuring realtime local object detection for IP cameras. The vulnerability exists in the integration between Frigate and the go2rtc streaming service, where insufficient input sanitization in the video stream configuration allows attackers to inject and execute arbitrary system commands.

Critical Impact
Attackers with administrative access or access to unsecured Frigate installations can achieve complete system compromise through command injection, potentially gaining full control over the underlying server and any connected surveillance infrastructure.

Affected Products

Frigate NVR versions prior to 0.16.4
Frigate installations integrated with go2rtc service
Systems with exposed administrative interfaces or lacking authentication

Discovery Timeline

2026-02-06 - CVE-2026-25643 published to NVD
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-25643

Vulnerability Analysis

This vulnerability represents a classic OS Command Injection flaw (CWE-78) where user-controlled input flows into system command execution without proper sanitization. The vulnerability specifically manifests in how Frigate handles video stream configurations within the config.yaml file.

When administrators configure video streams, the go2rtc service provides an exec: directive that allows execution of external commands for stream handling. The application fails to sanitize or validate user input passed through this directive, creating a direct injection point for malicious commands. Since go2rtc executes these commands without any restrictions or sandboxing, an attacker can leverage this to run arbitrary code with the privileges of the go2rtc process.

The attack surface is limited to administrators or scenarios where Frigate installations have been exposed to the internet without authentication. However, the lack of authentication on exposed instances means that any unauthenticated user could modify configurations and exploit this vulnerability.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the video stream configuration parser. The application directly passes user-supplied configuration values to the shell execution context through the exec: directive without implementing proper escaping, allowlisting, or command injection protections. This violates the security principle of never trusting user input, especially when that input is used in command execution contexts.

Attack Vector

The attack is network-accessible, requiring no user interaction but requiring high privileges (administrative access) or exploitation of misconfigured installations lacking authentication. An attacker can craft malicious configurations containing shell metacharacters and command sequences that break out of the intended execution context.

For example, an attacker with access to the configuration file could inject commands within the exec: directive value. When go2rtc processes the stream configuration, the injected commands execute on the underlying system. This could allow the attacker to establish reverse shells, exfiltrate sensitive data, pivot to other network resources, or completely compromise the surveillance infrastructure.

The vulnerability is particularly dangerous in environments where Frigate systems may have access to sensitive video feeds or are connected to broader network infrastructure.

Detection Methods for CVE-2026-25643

Indicators of Compromise

Unexpected modifications to config.yaml files, particularly in stream configuration sections containing the exec: directive
Unusual process spawning from the go2rtc service or its parent processes
Suspicious outbound network connections from the Frigate server to unknown destinations
Presence of shell metacharacters (;, |, &, $(), backticks) in configuration values

Detection Strategies

Monitor file integrity of Frigate configuration files using FIM (File Integrity Monitoring) solutions
Implement log analysis for go2rtc service to identify unusual command executions
Deploy network intrusion detection to identify reverse shell connections or command-and-control traffic originating from NVR systems
Review authentication logs for unauthorized administrative access attempts

Monitoring Recommendations

Enable verbose logging for both Frigate and go2rtc services to capture configuration changes and command executions
Implement alerting for any process execution chains originating from go2rtc that include common shell utilities like bash, sh, curl, wget, or nc
Monitor for file system changes in system directories that shouldn't be modified by the NVR application
Set up network monitoring for unusual traffic patterns from surveillance infrastructure to internal or external destinations

How to Mitigate CVE-2026-25643

Immediate Actions Required

Upgrade Frigate to version 0.16.4 or later immediately, which contains the security fix for this vulnerability
Ensure Frigate installations are not exposed directly to the internet without proper authentication mechanisms
Review existing config.yaml files for any suspicious or unexpected entries in stream configurations
Implement network segmentation to isolate NVR systems from critical infrastructure

Patch Information

The vulnerability has been addressed in Frigate version 0.16.4. The fix implements proper input sanitization for the video stream configuration to prevent command injection through the exec: directive. Users should update immediately by pulling the latest release from the official GitHub repository. Full details about the vulnerability and the fix are available in the GitHub Security Advisory.

Workarounds

If immediate patching is not possible, disable or restrict access to the administrative interface until the update can be applied
Place Frigate installations behind a reverse proxy with strong authentication (e.g., OAuth, mutual TLS)
Implement firewall rules to restrict access to Frigate management interfaces to trusted IP addresses only
Audit and remove any exec: directives from configuration files that are not strictly necessary for operation

bash

# Verify Frigate version after upgrade
docker exec -it frigate frigate --version
# Expected output: 0.16.4 or higher

# Check for exposed ports and restrict access
iptables -A INPUT -p tcp --dport 5000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP