VulnSocial

CVE-2026-33469Disclosure(frigate / frigate)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through `/api/config/raw`. This exposes sensitive values that are intentionally redacted from `/api/config`, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in `config.yml`. This appears to be a broken access control issue introduced by the admin-by-default API refactor: `/api/config/raw_paths` is admin-only, but `/api/config/raw` is still accessible to any authenticated user. Version 0.17.1 contains a patch.

frigate CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • frigate

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
frigate
Products
frigate

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-26: 2Technical Details · 2026-03-26: 203-26
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-33469 Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the ful… https://www.cve.org/CVERecord?id=CVE-2026-33469 ----- Traducción: CVE-2026-33469 Fri… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-33469 for Frigate NVR, noting that an authenticated non‑admin user can retrieve sensitive information in version 0.17.0.

    0000041
    65 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33469 Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the ful… https://www.cve.org/CVERecord?id=CVE-2026-33469

    Post summary

    CVE‑2026‑33469 is a disclosed flaw in Frigate 0.17.0 allowing authenticated non‑admin users to retrieve sensitive data, with no PoC, exploit, or patch information provided.

    00000227
    56.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfrigatefrigate0.17.0--

Explore more

Back to dashboardfrigate CVEsfrigate vulnerabilities