Frigate EUVD-2026-84531

Requires an auth-enabled Frigate deployment prior to 0.18.0 and valid credentials for at least a low-privilege 'viewer' account; the attacker then sends GET requests to the prefix-matched nginx location /api/go2rtc/api (subpaths streams, config, log, stack). Exploitation is limited to read-only GET disclosure - non-GET methods are blocked by limit_except GET, so no modification is possible - and the real-world payoff depends on RTSP stream URLs actually containing embedded camera credentials. It does not work against unauthenticated attackers or against instances already upgraded to 0.18.0 where the location block is removed.

This is a genuine but bounded confidentiality issue, not an inflated high-CVSS problem. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7) is internally consistent with the description: a network-reachable nginx location that authenticates the request but fails to enforce the administrator role (CWE-863), so a low-privileged authenticated viewer (PR:L) can read the proxied go2rtc API with no user interaction. The scope change (S:C) is defensible because the leaked RTSP URLs carry camera credentials that grant access to a separate security authority (the cameras themselves), and go2rtc is a distinct proxied component. C:H is warranted given camera credential disclosure; I:N/A:N are correct because non-GET methods stay blocked by limit_except GET, so no state can be altered. No EPSS score, no CISA KEV listing, and no public POC are present in the input - so there is no signal of active or automated exploitation; this is a targeted post-authentication information-disclosure bug, not a wormable internet-wide threat. The key limiter is that the attacker must already hold valid viewer credentials on an auth-enabled Frigate instance, which materially lowers real-world urgency versus an unauthenticated flaw. Priority is moderate: patch promptly where camera credentials are sensitive, but the authentication precondition and lack of exploitation signals keep this below emergency tier.

An authenticated low-privilege 'viewer' user on a Frigate instance (for example a household member or a compromised low-tier account) issues GET requests to /api/go2rtc/api/streams, /config, /log, and /stack. Because the nginx location checks authentication but not administrator role, the proxy returns internal addresses, configuration paths, application logs, goroutine stacks, and RTSP stream URLs that may embed camera credentials, which the attacker can then use to connect directly to the cameras. No public exploit code is identified at time of analysis, and the low attack complexity means the requests are trivial once viewer access exists.