PT-2026-28484 · Frigate · Frigate

Bg0D-Glitch · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-33469

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frigate version 0.17.0

Description Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated, non-administrator user can access the complete, unredacted Frigate configuration through the /api/config/raw API endpoint. This access exposes sensitive information intentionally hidden from the /api/config endpoint, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in the config.yml file. This issue stems from a broken access control mechanism introduced during the refactoring of the administrator API. Specifically, while /api/config/raw paths is restricted to administrators, the /api/config/raw endpoint remains accessible to any authenticated user. The vulnerable parameter is not explicitly mentioned.

Recommendations Update to version 0.17.1 or later to resolve this issue.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-33469

GHSA-26G3-F8G8-9FFH

Produtos afetados

Frigate

Referências · 6

• 🔥 https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33469.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33469 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33469 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2037281378115502350 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037280612416184332 · Publicação no Twitter