CVE-2026-33469: 
NixOS vulnerability analysis and mitigation

CVE-2026-33469 is a broken access control vulnerability in Frigate, an open-source network video recorder (NVR) with real-time local object detection for IP cameras. In version 0.17.0, any authenticated non-admin user can retrieve the full, unredacted Frigate configuration via the /api/config/raw API endpoint, exposing secrets intentionally redacted from the standard /api/config endpoint. The vulnerability was published on March 26, 2026, and a patch was released in version 0.17.1. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is an incorrect authorization flaw (CWE-863) introduced during an admin-by-default API refactor. While the related endpoint /api/config/raw_paths was correctly restricted to admin users, /api/config/raw was left accessible to any authenticated user via allow_any_authenticated() instead of require_role(["admin"]), and was also exempted from the global admin-by-default guard. The affected code resides in frigate/api/app.py and frigate/api/auth.py. An attacker only needs a valid low-privilege (e.g., viewer) account and network access to the Frigate API to exploit this — no special tools or complex techniques are required beyond a standard HTTP GET request with a Bearer token (GitHub Advisory).

Successful exploitation allows any authenticated non-admin user to extract the full contents of config.yml, including camera RTSP credentials, go2rtc stream credentials, MQTT passwords, proxy authentication secrets, and integration URLs and tokens. This represents a direct confidentiality impact with no integrity or availability effect. Exposed credentials can enable follow-on compromise of connected IP cameras, MQTT brokers, and other integrated infrastructure, making lateral movement a realistic risk (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a simple curl command that any authenticated user can execute against a vulnerable Frigate instance. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Obtain a low-privilege account: Authenticate to the Frigate instance as any non-admin user (e.g., a viewer account) and retrieve a valid JWT Bearer token via the Frigate login flow.
2. Send request to vulnerable endpoint: Issue a GET request to /api/config/raw on the target Frigate host (default port 8971) with the Bearer token:

   curl -sk -H "Authorization: Bearer $VIEWER_JWT" https://<frigate-host>:8971/api/config/raw

3. Extract secrets from response: The response contains the full unredacted config.yml, including camera RTSP credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other stored tokens.
4. Pivot to connected systems: Use the extracted credentials to access IP cameras directly, connect to MQTT brokers, or authenticate to other integrated services (GitHub Advisory).

• Network: Unexpected GET requests to /api/config/raw from non-admin user accounts or from unusual source IPs; repeated API calls to this endpoint outside of normal administrative activity.
• Logs: Frigate API access logs showing successful HTTP 200 responses to /api/config/raw for accounts with viewer or non-admin roles; authentication events for low-privilege accounts followed immediately by config retrieval requests.
• Behavioral: Subsequent authentication attempts to IP cameras, MQTT brokers, or go2rtc streams using credentials that were only stored in config.yml, suggesting credential harvesting from this endpoint (GitHub Advisory).

Upgrade Frigate to version 0.17.1 or later, which restricts /api/config/raw to admin users only. As an interim workaround, restrict network access to the Frigate API (port 8971) to trusted administrators only using firewall rules or network segmentation. Additionally, review access logs for any prior unauthorized access to /api/config/raw, and rotate all credentials stored in config.yml (camera accounts, MQTT passwords, stream credentials, proxy secrets) if the system was accessible to untrusted authenticated users (GitHub Advisory).

The vulnerability was reported by researcher bg0d-glitch and disclosed via GitHub's coordinated security advisory process on March 22, 2026. The Frigate maintainer published the advisory and released a patch (v0.17.1) promptly. No significant broader media coverage or notable public commentary beyond the advisory itself has been identified (GitHub Advisory).