CVE-2026-33126 - Vulnerability Analysis

Overview

Frigate < 0.16.3 contains a server-side request forgery caused by improper validation of user-controlled URLs in the /ffprobe endpoint, letting attackers make HTTP requests to internal resources, exploit requires crafted request.

Severity & Score

Impact

Attackers can make HTTP requests to internal network resources, cloud metadata services, or perform port scanning, potentially exposing sensitive information or enabling further attacks.

Mitigation

Update to version 0.16.3 or later.

References

• https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner