CVE-2026-25643

Frigate NVR ≤ 0.16.3 盲注 RCE 漏洞利用（CVE-2026-25643）PoC 📜 描述 此 Python 漏洞利用针对 Frigate NVR 0.16.3 及更早版本中的一个严重配置操纵漏洞（涵盖已认证和未认证两条路径）。通过注入恶意的 go2rtc 流和一个伪造的摄像头条目，它可在服务重启时以 Frigate 进程身份触发任意命令执行——无需反向 Shell 或输出捕获。 🛠️ 安装 !NOTE 为确保项目依赖拥有干净且隔离的环境，建议使用 Python 的 venv 模块。 OSX/Linux git clone...

CVE-2026-25643-Frigate-RCE

CVE-2026-25643：Frigate NVR = 0.16.3 已认证远程代码执行 漏洞标题： Frigate NVR = 0.16.3 - 已认证远程代码执行 日期： 2026-02-05 漏洞作者： jduardo2704 厂商主页： https://frigate.video/ 软件链接： https://github.com/blakeblackshear/frigate 版本： = 0.16.3 CVE： CVE-2026-25643 安全公告：...

CVE-2026-75608

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608

Frigate , an open-source network video recorder, had an authorization flaw in its nginx configuration (file docker/main/rootfs/usr/local/nginx/conf/nginx.conf). Prior to 0.18.0 , the prefix-matched location /api/go2rtc/api required authentication but did not enforce an administrator role for GET ...

EUVD-2026-84531

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608: Incorrect Authorization

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

PT-2026-96791

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.18.0 Description An authentication bypass exists where the prefix-matched location '/api/go2rtc/api' requires authentication but fails to enforce an administrator role for GET requests. This exposes the proxied go2r...

(Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Home Assistant Green. An attacker must first obtain the ability to access the device's localhost interface. The specific flaw exists within the go2rtc process. The issue results from the la...

(Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Home Assistant Green. An attacker must first obtain the ability to access the device's localhost interface. The specific flaw exists within the go2rtc process. The issue results from the la...

📄 Frigate NVR 0.16.3 Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in Frigate NVR versions 0.16.3 and below by manipulating the application's configuration through the go2rtc stream settings. The module retrieves the current configuration, safely parses and modifies it to introduce a controlle...

CVE-2026-25643

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution RCE vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream...

CVE-2026-25643

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution RCE vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream...

CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution RCE vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream...

CVE-2026-25643

Frigate (NVR) prior to version 0.16.4 is affected by a critical Remote Command Execution (RCE) vulnerability in the go2rtc integration. The root cause is improper sanitization of user input in the video stream configuration (config.yaml), permitting injection of system commands via the exec: dire...

EUVD-2026-5586

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution RCE vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream...

CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution RCE vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream...

CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution RCE vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream...