SSRF in Blakeblackshear Frigate
CVE-2026-33126
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (8.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N.
Affected products
- Blakeblackshear Frigate — versions < 0.16.3
- Frigate
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-33126?
- CVE-2026-33126 is a medium-severity vulnerability in Blakeblackshear Frigate, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2026-03-20.
- How severe is CVE-2026-33126?
- Medium severity. CVSS v3 base score is 5.0 out of 10.