CVE-2026-54652: Frigate Privilege Escalation Vulnerability

CVE-2026-54652 Overview

CVE-2026-54652 affects Frigate, an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user, including accounts with the viewer role, to download Frigate and nginx logs. These logs contain auto-generated admin passwords and camera credentials that appear in request query strings. An attacker with low-privilege access can extract these credentials and escalate to administrator. A fixed release has not been identified at time of publication. The weakness is classified under [CWE-269] Improper Privilege Management.

Critical Impact
A viewer-role account can retrieve nginx and application logs containing plaintext admin credentials, enabling full privilege escalation to Frigate administrator.

Affected Products

Frigate network video recorder version 0.17.1
Frigate deployments where nginx access logs record credentials in query strings
Any Frigate instance exposing the /api/logs/{service} endpoint to viewer-role users

Discovery Timeline

2026-07-08 - CVE-2026-54652 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54652

Vulnerability Analysis

The vulnerability resides in Frigate's log retrieval API. The route GET /api/logs/{service} is gated only by an authentication check and does not enforce a role-based authorization check. Any authenticated principal, including a viewer, can request logs for arbitrary services such as frigate and nginx. Because Frigate auto-generates admin credentials at first launch and logs certain requests that carry credentials in URL query strings, the returned log content contains sensitive secrets. An attacker recovers these secrets and reuses them to authenticate as administrator.

Root Cause

Two defects combine to produce the finding. First, sensitive credentials, including generated admin passwords and camera stream credentials, are written to logs via query-string parameters rather than being redacted at the sink. Second, the log-download endpoint applies coarse authentication instead of a least-privilege role check, so users who should only view camera feeds can read operational logs. This is a classic [CWE-269] Improper Privilege Management pattern.

Attack Vector

An attacker authenticates with any valid viewer account, issues a request to GET /api/logs/nginx or GET /api/logs/frigate, and parses returned lines for credentials embedded in URL parameters. The attacker then signs in as admin, gaining full control of camera configuration, stream URLs, and platform settings.

python

# Security patch in frigate/const.py - Improve credential redaction handling (#23265)

SHM_FRAMES_VAR = "SHM_MAX_FRAMES"

REDACTED_CREDENTIAL_SENTINEL = "__FRIGATE_SAVED_CREDENTIAL__"

# Attribute & Object constants

DEFAULT_ATTRIBUTE_LABEL_MAP = {

Source: GitHub Commit 68e8afd

python

# Security patch in frigate/api/app.py - API access improvements (#23183)

@router.get("/stats", dependencies=[Depends(allow_any_authenticated())])
def stats(
    request: Request,
    allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
):
    stats_data = request.app.stats_emitter.get_latest_stats()

    # Admins see the full snapshot
    if request.headers.get("remote-role") == "admin":
        return JSONResponse(content=stats_data)

    allowed_set = set(allowed_cameras)

    # Shallow-copy so we don't mutate the cached stats history entry.
    filtered = {**stats_data}

    cameras = stats_data.get("cameras")
    if cameras is not None:
        filtered["cameras"] = {
            name: data for name, data in cameras.items() if name in allowed_set
        }

Source: GitHub Commit bd1fc1c. The patch introduces role-aware filtering so non-admin callers only receive data scoped to permitted cameras, and a related change adds a REDACTED_CREDENTIAL_SENTINEL to suppress credentials from being persisted in logs and configuration exports.

Detection Methods for CVE-2026-54652

Indicators of Compromise

Unexpected GET /api/logs/frigate or GET /api/logs/nginx requests from accounts that only require viewer access.
nginx access log lines containing password=, user=, or credentialed RTSP URLs in query strings.
Admin logins from IP addresses previously associated only with viewer sessions.
Configuration changes to camera stream URLs or authentication settings shortly after a log-download request.

Detection Strategies

Alert on any authenticated call to /api/logs/{service} where the caller's role is not admin.
Search historical logs for query-string patterns exposing camera or admin credentials.
Correlate viewer-session activity with subsequent admin authentications from the same client fingerprint.

Monitoring Recommendations

Forward Frigate application and nginx access logs to a central log platform and retain them for review.
Enable authentication event logging and baseline normal per-role API usage.
Monitor for credential material appearing in URL parameters and flag it for rotation.

How to Mitigate CVE-2026-54652

Immediate Actions Required

Restrict access to the Frigate management interface to trusted networks until a fixed release is available.
Rotate the auto-generated admin password and all camera credentials, especially if viewer accounts exist.
Remove or downgrade non-essential viewer accounts and audit existing role assignments.
Purge historical nginx and application logs that may contain credentials in query strings.

Patch Information

A fixed release has not been identified. Upstream mitigations are tracked in the Frigate Security Advisory GHSA-c4qf-xxq4-vf55. Related credential redaction and role-based access improvements have been committed in 68e8afd and bd1fc1c. Track the advisory for an official patched version.

Workarounds

Place Frigate behind a reverse proxy that blocks /api/logs/ for non-admin sessions.
Configure camera stream URLs to use header-based or credential-store authentication rather than embedding secrets in URLs.
Reduce nginx log verbosity to omit query strings, or apply a log filter that redacts password, user, and RTSP credentials before write.
Segment the Frigate host on a management VLAN with strict ACLs limiting who can reach the API.

bash

# Configuration example: block log endpoint for non-admin sessions at reverse proxy
location ~ ^/api/logs/ {
    # Only forward if upstream auth header indicates admin role
    if ($http_remote_role != "admin") {
        return 403;
    }
    proxy_pass http://frigate_upstream;
}

# Redact credentials from nginx access logs
log_format redacted '$remote_addr - $remote_user [$time_local] '
                    '"$request_method $uri" $status $body_bytes_sent';
access_log /var/log/nginx/access.log redacted;