CVE-2026-33126

published 2026-03-20

CVE-2026-33126: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary…

Priority P4 27 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I L A N

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
blakeblackshear	frigate	< 0.16.3	0.16.3
frigate	frigate	< 0.16.3	0.16.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918