CVE-2026-33469

MEDIUM 6.5

Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through `/api/config/raw`. This exposes sensitive values that are intentionally redacted from `/api/config`, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in `config.yml`. This appears to be a broken access control issue introduced by the admin-by-default API refactor: `/api/config/raw_paths` is admin-only, but `/api/config/raw` is still accessible to any authenticated user. Version 0.17.1 contains a patch.

CWE	CWE-863
Vendor	blakeblackshear
Product	frigate
Published	Mar 26, 2026
Last Updated	Mar 26, 2026

Stay Ahead of the Next One

Get instant alerts for blakeblackshear frigate

Be the first to know when new medium vulnerabilities affecting blakeblackshear frigate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

blakeblackshear / frigate

= 0.17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh