CVE-2026-75608: Frigate NVR Information Disclosure Flaw

CVE-2026-75608 Overview

Frigate is an open source network video recorder used to manage IP camera feeds. CVE-2026-75608 is a broken access control flaw [CWE-863] in Frigate versions prior to 0.18.0. The prefix-matched Nginx location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf enforces authentication but does not require an administrator role for GET requests. Any authenticated viewer can proxy requests to the underlying go2rtc API and retrieve sensitive information. The issue is fixed in version 0.18.0.

Critical Impact
Authenticated viewer users can obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may embed camera credentials.

Affected Products

Frigate NVR versions prior to 0.18.0
Deployments using the Docker image with the bundled nginx.conf
Installations exposing the /api/go2rtc/api proxied endpoint

Discovery Timeline

2026-09-22 - CVE-2026-75608 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75608

Vulnerability Analysis

Frigate's Nginx configuration exposes the go2rtc administration API through the /api/go2rtc/api proxy location. The location block applies auth_request.conf to require authentication and uses limit_except GET { deny all; } to block state-changing methods. It does not, however, enforce a role check restricting access to administrators.

Because Nginx performs prefix matching, subpaths such as /api/go2rtc/api/streams, /api/go2rtc/api/config, /api/go2rtc/api/log, and /api/go2rtc/api/stack are all reachable through the same block. Viewer accounts, which are intended to have read-only access to camera streams, can query these subpaths and receive full responses from the backend go2rtc service.

The returned data includes internal listener addresses, on-disk configuration paths, live application logs, and Go runtime goroutine stack traces. The streams endpoint additionally reveals RTSP source URLs, which frequently contain camera credentials embedded as rtsp://user:password@host strings.

Root Cause

The Nginx location gates access on authentication only. There is no auth_request variant or upstream check that validates the caller's role against an administrator scope. Because go2rtc itself has no independent authentication when reached through the proxy, the missing role check collapses the entire authorization boundary between viewer and administrator for GET traffic.

Attack Vector

An attacker requires valid viewer credentials on the Frigate instance. Once authenticated, the attacker issues GET requests to subpaths under /api/go2rtc/api from any network-reachable client. No user interaction or elevated privileges are needed to retrieve the exposed data.

text

// Patch from docker/main/rootfs/usr/local/nginx/conf/nginx.conf
// The vulnerable proxy location for /api/go2rtc/api is removed entirely.
             include proxy.conf;
         }
 
-        # frontend uses this to fetch the version
-        location /api/go2rtc/api {
-            include auth_request.conf;
-            limit_except GET {
-                deny  all;
-            }
-            proxy_pass http://go2rtc/api;
-            include proxy.conf;
-        }
-
         # integration uses this to add webrtc candidate
         location /api/go2rtc/webrtc {
             include auth_request.conf;

Source: GitHub commit 520d9ee

Detection Methods for CVE-2026-75608

Indicators of Compromise

Nginx access log entries showing GET requests to /api/go2rtc/api/streams, /api/go2rtc/api/config, /api/go2rtc/api/log, or /api/go2rtc/api/stack from viewer-role sessions.
Repeated polling of /api/go2rtc/api subpaths from a single authenticated session or source IP.
Outbound RTSP connections to camera IPs originating from hosts other than the Frigate server after viewer authentication events.

Detection Strategies

Correlate the authenticated user role from Frigate's auth backend with Nginx URI patterns to flag any non-admin account touching /api/go2rtc/api/*.
Alert on responses to /api/go2rtc/api/streams larger than a baseline value, which indicates full stream configuration retrieval.
Monitor for goroutine stack dumps or log content appearing in HTTP responses served by the Frigate front-end proxy.

Monitoring Recommendations

Forward Nginx access and error logs from the Frigate container to a centralized log platform for retention and query.
Track creation and use of viewer-role accounts, especially accounts created shortly before access to /api/go2rtc/api subpaths.
Rotate and monitor RTSP camera credentials for reuse from unexpected source addresses.

How to Mitigate CVE-2026-75608

Immediate Actions Required

Upgrade Frigate to version 0.18.0, which removes the vulnerable /api/go2rtc/api proxy block.
Rotate any RTSP camera credentials that were configured in go2rtc streams while a vulnerable version was deployed.
Audit viewer accounts and revoke credentials that are no longer required or that show anomalous access patterns.

Patch Information

The fix is delivered in Frigate 0.18.0. Commit 520d9ee removes the direct go2rtc API proxy location in favor of dedicated Frigate API endpoints. Additional context is available in Pull Request #22735, the v0.18.0 release notes, and GitHub Security Advisory GHSA-mgh5-cr9h-g6hr.

Workarounds

Restrict network access to the Frigate web interface to trusted administrators until the upgrade to 0.18.0 is applied.
Add a custom Nginx rule in front of Frigate that denies GET requests to /api/go2rtc/api and its subpaths for non-administrator sessions.
Remove or disable viewer-role accounts on vulnerable deployments where administrator-only access is acceptable.

bash

# Temporary Nginx snippet to block access to the exposed proxy path
# Place in a reverse proxy in front of Frigate until upgrading to 0.18.0
location ~ ^/api/go2rtc/api(/|$) {
    return 403;
}