CVE-2026-54652— Frigate viewer can read logs exposing admin and camera credentials
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| blakeblackshear | frigate | <= 0.17.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54652
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frigate viewer can read logs exposing admin and camera credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Frigate 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
frigate是Frigate团队开源的一款视频分析软件。 Frigate 0.17.1及之前版本存在安全漏洞，该漏洞源于对GET /api/logs/{service}端点的访问控制不足，导致所有认证用户（包括viewer角色）可下载Frigate和nginx日志，从而暴露自动生成的管理员密码和查询字符串中的摄像头凭据，并实现从viewer到admin的权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| blakeblackshear | frigate | <= 0.17.1 | - |
II. Public POCs for CVE-2026-54652
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7285 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-54652
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54652 (2)
Vendor Advisories for CVE-2026-54652 (1)
IV. Related Vulnerabilities
Same product: frigate
- CVE-2026-33470
Frigate has cross-camera snapshot disclosure via unrestricte - CVE-2026-33469
Authenticated Frigate users can read the full unredacted con - CVE-2026-33126
Frigate has SSRF vulnerability in /ffprobe endpoint - CVE-2026-33125
Frigate Broken Access Control: Users assigned the viewer rol - CVE-2026-33124
Frigate has insecure password change functionality
Same vendor: blakeblackshear
- CVE-2026-33470
Frigate has cross-camera snapshot disclosure via unrestricte - CVE-2026-33469
Authenticated Frigate users can read the full unredacted con - CVE-2026-33126
Frigate has SSRF vulnerability in /ffprobe endpoint - CVE-2026-33125
Frigate Broken Access Control: Users assigned the viewer rol - CVE-2026-33124
Frigate has insecure password change functionality
Same weakness: CWE-269
- CVE-2026-75924
Managed-serviceaccount: managed-serviceaccount: hub addon-ma - CVE-2026-75857
CodeWhale before 0.8.64 Privilege Escalation via exec_shell_ - CVE-2026-75851
ArcadeDB before 26.8.1 Authentication Bypass via Async Comma - CVE-2026-75845
ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_s - CVE-2026-75843
ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transac
V. Comments for CVE-2026-54652
No comments yet