SSRF in Blakeblackshear Frigate
CVE-2026-33126
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (17.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 17.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Blakeblackshear Frigate — versions < 0.16.3
- Frigate
Weakness classification (CWE)
References
- github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv (Exploit, Mitigation, Vendor Advisory)
- github.com/blakeblackshear/frigate/releases/tag/v0.16.3 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-33126?
- CVE-2026-33126 is a medium-severity vulnerability in Blakeblackshear Frigate, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2026-03-20.
- How severe is CVE-2026-33126?
- Medium severity. CVSS v3 base score is 5.0 out of 10.