Description
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.
Published: 2026-07-08
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Frigate version 0.17.1 the GET /api/logs/{service} endpoint allows any authenticated user, including those with the viewer role, to download all logs that contain auto-generated admin credentials logged in query strings; an attacker can therefore recover privileged credentials breach and full control of the system, a flaw mapped to CWE-269, CWE-532, CWE-598, and CWE-863.

Affected Systems

The affected system is the Frigate open-source network video recorder by blakeblackshear, specifically the 0.17.1 release; no other vendors or products are recorded as impacted, although the risk could persist credentials until a fix is confirmed.

Risk and Exploitability

The CVSS score of 8.1 marks this flaw as high severity, yet the EPSS score of less than 1% and it is not listed in CISA’s KEV catalog; an attacker must already be authenticated, credentials are recovered the of rapid privilege escalation real even if exploitation rates are low.

Generated by OpenCVE AI on July 26, 2026 at 17:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the commit changes referenced in the advisory to sanitize log output, as no official release contains a fix yet.
  • Restrict access to the /api/logs/{service} endpoint so that only administrators can download logs, or disable the endpoint entirely if it is not required.
  • Audit existing log files for any captured admin or camera credentials and rotate those credentials immediately after remediation.
  • Review and adjust logging configurations to ensure future logs do not include sensitive query parameters or credentials.

Generated by OpenCVE AI on July 26, 2026 at 17:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Blakeblackshear
Blakeblackshear frigate
Vendors & Products Blakeblackshear
Blakeblackshear frigate

Wed, 08 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.
Title Frigate viewer can read logs exposing admin and camera credentials
Weaknesses CWE-269
CWE-532
CWE-598
CWE-863
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Blakeblackshear Frigate
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-08T15:20:23.777Z

Reserved: 2026-06-15T20:16:46.199Z

Link: CVE-2026-54652

cve-icon Vulnrichment

Updated: 2026-07-08T15:20:18.921Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T18:00:05Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-532

    Insertion of Sensitive Information into Log File

  • CWE-598

    Use of HTTP Request With Sensitive Query String

  • CWE-863

    Incorrect Authorization