VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Mar 20, 2026· Updated Jun 17, 2026

CVE-2026-33126

CVE-2026-33126

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Frigate/Frigate2 versions
    cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*range: <0.16.3
    • (no CPE)range: <0.16.3
  • Blakeblackshear/Frigatecpe-rescue
    Range: < 0.16.3

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.