CVE-2026-75608 blakeblackshear CVE debrief

Who should care

Defenders responsible for Frigate deployments, particularly those with viewer user roles, should assess exposure and prioritize updating to version 0.18.0 or later to mitigate potential information disclosure.

Why it matters

CVE-2026-75608 allows authenticated viewer users in Frigate versions prior to 0.18.0 to access sensitive information via the go2rtc API, potentially disclosing internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Defenders should prioritize updating to version 0.18.0 or later and restrict access to go2rtc API endpoints to administrator roles.

• Authenticated viewers may have accessed internal addresses and configuration paths
• Exposure of application logs and goroutine stack data may have occurred
• RTSP stream URLs potentially containing camera credentials may have been disclosed
• Verification of authentication and authorization for API requests is necessary

Technical summary

Frigate versions prior to 0.18.0 contain an authentication bypass vulnerability in the go2rtc API. The /api/go2rtc/api path in nginx.conf requires authentication but does not enforce administrator roles for GET requests, allowing authenticated viewer users to access internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials.

Defensive priority

Authenticated users with viewer roles may have been able to access sensitive information via the go2rtc API prior to Frigate version 0.18.0.

Recommended defensive actions

• Review and update Frigate deployments to version 0.18.0 or later
• Restrict access to go2rtc API endpoints to administrator roles
• Monitor for and limit exposure of internal addresses and camera credentials
• Verify authentication and authorization for API requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry detail an authentication bypass in Frigate versions prior to 0.18.0, allowing viewers to access go2rtc API endpoints. Official CVE and NVD records provide vulnerability details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.