EUVD-2026-13772Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.
AnalysisAI
Frigate versions prior to 0.16.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the /ffprobe endpoint that accepts arbitrary user-controlled URLs without proper validation. An authenticated attacker can leverage this endpoint to make HTTP requests to internal network resources, cloud metadata services (such as AWS IMDSv1), or perform reconnaissance activities like port scanning against systems accessible from the Frigate server. The vulnerability requires low privileges (authenticated user) and has a network attack vector with low complexity, making it moderately exploitable in environments where Frigate is exposed to untrusted users.
Technical ContextAI
The vulnerability exists in Frigate (identified via CPE cpe:2.3:a:blakeblackshear:frigate:*:*:*:*:*:*:*:*), an open-source network video recorder application that integrates ffprobe for media introspection. The /ffprobe endpoint constructs HTTP requests based on user-supplied URL parameters without implementing URL validation, whitelist enforcement, or blocking of internal IP ranges (RFC 1918 addresses, 169.254.169.254 for cloud metadata, localhost, etc.). This directly maps to CWE-918 (Server-Side Request Forgery), a class of vulnerabilities where attackers can induce an application to make unintended requests to arbitrary destinations. The root cause is insufficient input validation on URL parameters combined with lack of network segmentation controls within the application logic.
RemediationAI
Upgrade Frigate to version 0.16.3 or later immediately (see vendor release at https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3 and advisory at https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv). For environments unable to patch immediately, implement network-level controls by restricting outbound connections from the Frigate container or process to only necessary external resources, blocking access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254), and enforce firewall rules on the host. Additionally, restrict API access to the /ffprobe endpoint via authentication/authorization controls and review Frigate user permissions to ensure only trusted administrators can invoke ffprobe operations.
Frigate NVR has a command injection vulnerability (CVSS 9.1) allowing authenticated attackers to execute OS commands on
Frigate is an open source network video recorder. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
Frigate is an open source network video recorder. Rated medium severity (CVSS 6.8), this vulnerability is remotely explo
Frigate versions prior to 0.17.0-beta1 contain an authentication weakness that allows any authenticated user to change a
Frigate is an open source network video recorder. Rated medium severity (CVSS 4.7), this vulnerability is remotely explo
Frigate network video recorder versions prior to 0.17.1 allow authenticated users with restricted camera access to enume
Broken access control in Frigate 0.17.0 allows authenticated non-admin users to retrieve the complete raw configuration
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today