PT-2026-28484 · Frigate · Frigate

Bg0D-Glitch · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33469

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frigate version 0.17.0

Description Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated, non-administrator user can access the complete, unredacted Frigate configuration through the /api/config/raw API endpoint. This access exposes sensitive information intentionally hidden from the /api/config endpoint, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in the config.yml file. This issue stems from a broken access control mechanism introduced during the refactoring of the administrator API. Specifically, while /api/config/raw paths is restricted to administrators, the /api/config/raw endpoint remains accessible to any authenticated user. The vulnerable parameter is not explicitly mentioned.

Recommendations Update to version 0.17.1 or later to resolve this issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33469

GHSA-26G3-F8G8-9FFH

Affected Products

Frigate

References · 6

• 🔥 https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33469.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33469 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33469 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2037281378115502350 · Twitter Post
• https://twitter.com/CVEnew/status/2037280612416184332 · Twitter Post