CVE-2026-75608

Executive Summary

CVE-2026-75608 is an improper authorization vulnerability in Frigate, an open source network video recorder, affecting versions prior to 0.18.0. An authenticated user with only the viewer role can issue GET requests to the nginx-proxied go2rtc API path /api/go2rtc/api, which is prefix-matched in docker/main/rootfs/usr/local/nginx/conf/nginx.conf and requires authentication but not administrative privileges. Successful exploitation exposes internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may embed camera credentials, resulting in high confidentiality impact across a scope change (the nginx proxy boundary to the go2rtc service).

Technical Analysis

The vulnerability is classified as CWE-863 (Incorrect Authorization). Frigate's front-end web tier is served by nginx, and the configuration file docker/main/rootfs/usr/local/nginx/conf/nginx.conf contains a location block that prefix-matches /api/go2rtc/api. This location proxies requests to the embedded go2rtc streaming API.

The core defect is an authorization check that verifies only that the requester is an authenticated user, not that the requester holds an administrator role. Because the check is scoped to authentication rather than role-based authorization, any account — including the low-privilege viewer role — satisfies the gate for GET requests. The configuration applies limit_except GET, meaning that non-GET methods (POST, PUT, DELETE, etc.) are blocked, but GET is permitted.

Because the location directive performs prefix matching on /api/go2rtc/api, an attacker can request the streams, config, log, and stack subpaths. According to the NVD description, these subpaths yield:

• internal addresses,
• configuration paths,
• application logs,
• goroutine stack data,
• RTSP stream URLs that may contain camera credentials.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N describes a network-reachable, low-complexity attack requiring low privileges (an authenticated viewer account) with no user interaction. Scope is marked Changed (S:C) because the nginx authorization boundary is crossed into the go2rtc service. Confidentiality impact is High; integrity and availability impacts are None — this is a pure information disclosure issue with no write or denial-of-service primitive described.

No public proof-of-concept, exploit code, or Nuclei template was identified in the tracked sources. Vendor and product are recorded as "Unknown / Unknown" in the supplied CVE metadata, but the NVD description identifies the product as Frigate and the configuration path verbatim. Insufficient detail is available regarding the exact authentication middleware or session model in use; analysis is therefore bounded to the nginx location-matching and method-restriction behavior explicitly described.

Exploitation Scenarios

The following chain is inferred from the NVD description and the vulnerability class (incorrect authorization on a prefix-matched reverse-proxy location). No public exploit or PoC is available.

1. Reconnaissance / target identification. An attacker identifies an internet- or network-exposed Frigate instance, for example via Shodan using HTML/title fingerprints for the Frigate web UI. The attacker must obtain a valid authenticated session with the viewer role — either via legitimate low-privilege provisioning, a leaked/weak credential, or any separate credential-compromise path.

2. Triggering the flaw. With a viewer session, the attacker sends GET requests to the prefix-matched path /api/go2rtc/api and its subpaths. The nginx location block passes the request because it enforces authentication only, not the administrator role. Since only GET is permitted by limit_except GET, the attacker restricts requests to GET methods.

3. Payload / execution method (vulnerability-class level). This is not a code-injection exploit — it is an authorization-bypass information-disclosure attack. The "payload" is simply a GET request to the accessible subpaths (e.g., streams, config, log, stack). The attacker iterates subpaths to harvest the responses the go2rtc API returns to an authenticated-but-unauthorized caller.

4. Post-exploitation impact. The responses disclose internal addressing, configuration paths, application logs, goroutine stack traces, and RTSP stream URLs that may contain embedded camera credentials. The attacker can then pivot: discovered RTSP URLs with credentials may permit direct access to camera video streams, configuration paths and internal addresses support further lateral movement, and log/stack data may reveal additional weaknesses or operational details.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Per the CVSS v3.1 vector (7.7, High), the impact is concentrated in confidentiality:

• Attack Vector (AV:N): Remotely exploitable over the network.
• Attack Complexity (AC:L): No special conditions; the flawed authorization check is deterministic.
• Privileges Required (PR:L): Requires an authenticated viewer account.
• User Interaction (UI:N): No victim interaction required.
• Scope (S:C): The nginx authorization boundary is crossed; the impact extends into the go2rtc service.
• Confidentiality (C:H): High — logs, configuration, stack data, internal addresses, and RTSP URLs (potentially containing camera credentials) are exposed.
• Integrity (I:N) / Availability (A:N): None described.

Business impact. Frigate is commonly deployed for physical security and video surveillance. Leakage of RTSP stream URLs containing camera credentials can directly undermine the confidentiality of video feeds — a significant privacy, safety, and compliance concern (e.g., surveillance footage exposure, GDPR/privacy implications). Exposure of internal addresses and configuration paths aids an attacker in mapping the environment and staging follow-on attacks against cameras or adjacent infrastructure.

Affected systems. Any Frigate deployment prior to 0.18.0 that is reachable by an authenticated viewer account. Internet-exposed instances amplify risk, but internal deployments remain exposed to any authenticated low-privilege user. No CISA KEV listing and no confirmed exploit-in-the-wild evidence were present at the time of writing; EPSS had not been scored.

Detection Guidance

Sigma Rule

title: Frigate go2rtc API Viewer Role Authorization Bypass Attempt (CVE-2026-75608)
id: 8f3c1a2b-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects GET requests to the nginx-proxied go2rtc API path on Frigate instances by non-admin users, targeting subpaths exposed by CVE-2026-75608.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75608
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1213
  - attack.collection
  - cve.2026-75608
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|startswith:
      - '/api/go2rtc/api'
  selection_sensitive:
    cs-uri-stem|contains:
      - '/streams'
      - '/config'
      - '/log'
      - '/stack'
  selection_method:
    cs-method: 'GET'
  condition: selection_path and selection_sensitive and selection_method
falsepositives:
  - Legitimate administrator access to the go2rtc API
level: medium

YARA Rule

rule CVE_2026_75608_Frigate_Go2rtc_Config_Disclosure
{
    meta:
        description = "Detects nginx or Frigate configuration referencing the prefix-matched go2rtc API location associated with CVE-2026-75608"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75608"
        date = "2026-01-01"
        severity = "high"
    strings:
        $nginx = "docker/main/rootfs/usr/local/nginx/conf/nginx.conf"
        $loc = "/api/go2rtc/api"
        $limit = "limit_except GET"
    condition:
        any of ($nginx, $loc) or ($loc and $limit)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75608 Frigate go2rtc API Unauthorized Viewer GET to Sensitive Subpath"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/go2rtc/api"; startswith; http.uri; content:"/streams"; nocase; http.uri; content:"/config"; nocase; http.uri; content:"/log"; nocase; http.uri; content:"/stack"; nocase; classtype:attempted-recon; reference:cve,2026-75608; sid:202675608; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "GET" and http.request.uri like "/api/go2rtc/api*" ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, cs_uri_stem, url)
| where match(uri, "^/api/go2rtc/api")
| where match(uri, "(/streams|/config|/log|/stack)")
| search method="GET" OR cs_method="GET"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,frigate,cve-2026-75608">
  <rule id="2026756" level="10">
    <if_sid>31100</if_sid>
    <id>^311</id>
    <match>/api/go2rtc/api</match>
    <regex>/api/go2rtc/api/(streams|config|log|stack)</regex>
    <description>CVE-2026-75608: Potential Frigate go2rtc API authorization bypass - GET request to sensitive go2rtc subpath</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_75608,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to the Frigate web interface and the /api/go2rtc/api path to trusted networks; do not expose Frigate directly to the internet.
   • Reduce the number of accounts assigned the viewer role and audit existing viewer accounts for legitimacy.
   • Where perimeter controls allow, block or filter requests to /api/go2rtc/api and its streams, config, log, and stack subpaths for non-administrator sessions.
   • Avoid placing camera credentials directly in RTSP URLs where possible, since leaked stream URLs may embed them.

2. Patch / upgrade steps

   • Upgrade Frigate to version 0.18.0, which the NVD description states fixes this issue.
   • No vendor advisory, commit reference, or patch hash was available from tracked sources; validate the fix by confirming the deployed version and re-testing viewer-role access to the affected subpaths after upgrade.

3. Long-term hardening

   • Enforce role-based authorization (not just authentication) on all reverse-proxied API locations, and treat any prefix-matched location as a potential authorization surface.
   • Adopt deny-by-default for administrative API subpaths and review limit_except method restrictions to confirm they are not relied upon for authorization.
   • Segment camera and NVR networks from general user networks, and rotate any camera credentials that may have been exposed via RTSP URLs in logs or configuration.

References

• NVD — CVE-2026-75608: https://nvd.nist.gov/vuln/detail/CVE-2026-75608
• Frigate project (official documentation and release notes for version 0.18.0)
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

No threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing were identified for CVE-2026-75608 at the time of writing. No public PoC, exploit code, or Nuclei template was available.