CVE-2026-25643
Frigate
- Published
- 6 February 2026
- Last modified
- 17 June 2026
- CVSS
- 9.1 v3.1
- Severity
- critical
- EPSS
- 2.9% (86th pct)
- CISA KEV
- Not listed
- NVD status
- Analyzed
- Weaknesses
- CWE-78, CWE-250, CWE-269, CWE-668
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 2.9% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| Frigate | Frigate | unknown | 0.13.0, 0.17.0, < 0.16.3, < 0.16.4 +2 |
References
Vendor advisory and patch
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6x
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6x
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.