What is the CVSS score of EUVD-2026-16266?

EUVD-2026-16266 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Frigate are affected by EUVD-2026-16266?

Organizations using user can retrieve the full raw Frigate configuration should be aware of notable risk from CVE-2026-33469, a incorrect authorization vulnerability rated CVSS 6.5.

How to fix or mitigate EUVD-2026-16266?

Within 30 days: Identify affected systems running user can retrieve the full raw Frigate configuration and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Frigate EUVD-2026-16266

| CVE-2026-33469 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

Authentication Bypass Frigate Blakeblackshear

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 17:15 euvd

EUVD-2026-16266

Analysis Generated

Mar 26, 2026 - 17:15 vuln.today

CVE Published

Mar 26, 2026 - 17:05 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through /api/config/raw. This exposes sensitive values that are intentionally redacted from /api/config, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in config.yml. This appears to be a broken access control issue introduced by the admin-by-default API refactor: /api/config/raw_paths is admin-only, but /api/config/raw is still accessible to any authenticated user. Version 0.17.1 contains a patch.

AnalysisAI

Broken access control in Frigate 0.17.0 allows authenticated non-admin users to retrieve the complete raw configuration file via the /api/config/raw endpoint, exposing camera credentials, RTMP stream passwords, MQTT secrets, and proxy authentication tokens that are intentionally redacted from the standard /api/config API. The vulnerability stems from inconsistent authorization enforcement between /api/config/raw_paths (admin-only) and /api/config/raw (authenticated-user-accessible), introduced during an admin-by-default API refactor. Patch version 0.17.1 is available; publicly available exploit code exists but the vulnerability is not confirmed as actively exploited in the wild.

Technical ContextAI

Frigate (cpe:2.3:a:blakeblackshear:frigate:0.17.0) is a network video recorder (NVR) application that centralizes IP camera feeds and performs local object detection. The vulnerability is classified as CWE-863 (Incorrect Authorization), a broken access control flaw where authorization checks are bypassed or inconsistently applied. The root cause involves the REST API layer failing to enforce role-based access control (RBAC) consistently: the /api/config/raw_paths endpoint correctly implements admin-only restrictions, but the /api/config/raw endpoint-which returns the complete, unfiltered configuration object-lacks equivalent authorization checks. This allows any user who has authenticated to the Frigate API (e.g., through valid credentials, API tokens, or session cookies) to access sensitive configuration data that the application intentionally redacts from user-facing endpoints.

RemediationAI

Upgrade Frigate to version 0.17.1 or later immediately to receive the vendor-released patch that restores admin-only access control to the /api/config/raw endpoint. Until patching is possible, implement network-level access controls by restricting API access to trusted hosts or subnets via firewall rules, reverse proxy authentication filters, or VPN-only connectivity. Additionally, audit API token usage and rotate any long-lived API credentials; consider issuing short-lived, role-scoped tokens to limit blast radius if a token is compromised. Rotate all exposed secrets (camera passwords, MQTT credentials, proxy tokens) identified in any configuration file access logs. See the GitHub security advisory at https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh for patch details and https://vuldb.com/?id.353700 for additional context.