Advisories · Technology
blakeblackshear frigate.
Every CVE that names blakeblackshear frigate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
- blakeblackshear frigate
- Broken access control
- CVSS 8.1 High
Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
- blakeblackshear frigate
- Broken access control
- CVSS 8.1 High
Frigate viewer can read logs exposing admin and camera credentials
- blakeblackshear frigate
- Privilege escalation
- Information disclosure
- CVSS 6.5 Medium
Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp
- blakeblackshear frigate
- Broken access control
- CVSS 6.5 Medium
Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw
- blakeblackshear frigate
- Broken access control
- CVSS 5.0 Medium
Frigate has SSRF vulnerability in /ffprobe endpoint
- blakeblackshear frigate
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Frigate has insecure password change functionality
- blakeblackshear frigate
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
- blakeblackshear frigate
- Command injection
- Privilege escalation
- CVSS 7.7 High
Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter
- blakeblackshear frigate
- Path traversal
- CVSS 7.5 High
Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`
- blakeblackshear frigate
- Insecure deserialization
- CVSS 4.7 Medium
Frigate reflected XSS through `/<camera_name>` API endpoints
- blakeblackshear frigate
- Cross-site scripting (XSS)
- CVSS 7.5 High
Frigate cross-site request forgery in `config_save` and `config_set` request handlers
- blakeblackshear frigate
- Cross-site request forgery (CSRF)