CVE-2026-33126

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33126", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T20:35:49.926Z", "datePublished": "2026-03-20T19:57:16.438Z", "dateUpdated": "2026-03-25T13:57:25.515Z"}, "containers": {"cna": {"title": "Frigate has SSRF vulnerability in /ffprobe endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv"}, {"name": "https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3"}], "affected": [{"vendor": "blakeblackshear", "product": "frigate", "versions": [{"version": "< 0.16.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T19:57:16.438Z"}, "descriptions": [{"lang": "en", "value": "Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3."}], "source": {"advisory": "GHSA-j6g3-3j3q-c2xv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:57:17.023633Z", "id": "CVE-2026-33126", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:57:25.515Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33126", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:57:17.023633Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:57:22.339Z"}}], "cna": {"title": "Frigate has SSRF vulnerability in /ffprobe endpoint", "source": {"advisory": "GHSA-j6g3-3j3q-c2xv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "blakeblackshear", "product": "frigate", "versions": [{"status": "affected", "version": "< 0.16.3"}]}], "references": [{"url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv", "name": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3", "name": "https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T19:57:16.438Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33126", "state": "PUBLISHED", "dateUpdated": "2026-03-25T13:57:25.515Z", "dateReserved": "2026-03-17T20:35:49.926Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T19:57:16.438Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "frigate", "vendor": "blakeblackshear", "versions": [{"status": "affected", "version": "< 0.16.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B744C6E-3CD3-4E1B-86E8-4159D6364293", "versionEndExcluding": "0.16.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3."}, {"lang": "es", "value": "Frigate es un grabador de v\u00eddeo en red (NVR) con detecci\u00f3n de objetos local en tiempo real para c\u00e1maras IP. Antes de la versi\u00f3n 0.16.3, el endpoint /ffprobe acepta URLs arbitrarias controladas por el usuario sin la validaci\u00f3n adecuada, permitiendo ataques de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). Un atacante puede usar el servidor Frigate para realizar peticiones HTTP a recursos de red internos, servicios de metadatos en la nube o realizar escaneo de puertos. Este problema ha sido parcheado en la versi\u00f3n 0.16.3."}], "id": "CVE-2026-33126", "lastModified": "2026-06-17T10:36:59.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33126", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T13:57:17.023633Z", "version": "2.0.3"}}]}, "published": "2026-03-20T20:16:48.597", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "frigate", "source": "cna", "vendor": "blakeblackshear"}, "product": "frigate", "vendor": "blakeblackshear"}], "analysis": {"en": {"generated_at": "2026-03-23T20:27:23.431748+00:00", "value": {"mitigation_remediation": ["Update Frigate to version 0.16.3 or later to apply the official patch.", "Restrict external access to the /ffprobe endpoint or disable it if not required.", "Place the Frigate server behind a firewall or only expose it to trusted networks.", "Monitor service logs for unexpected /ffprobe calls or outbound HTTP requests to unusual hosts.", "Consider network segmentation to limit the impact if an internal resource is accessed."], "summary": {"action": "Immediate Patch", "impact": "Server-Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Frigate network video recorder (NVR) developed by blakeblackshear. All releases prior to version 0.16.3 are vulnerable. Versions 0.16.3 and later contain a patch that validates URLs before processing.", "description_and_impact": "An attacker who can send a crafted HTTP request to the Frigate server\u2019s /ffprobe endpoint can cause the server to fetch any arbitrary URL. The request is made without URL validation, allowing the attacker to force the server to contact internal network hosts, cloud instance metadata services, or perform port scans. This vulnerability (CWE\u2011918) can lead to information disclosure and potential escalation to other internal resources, but it does not directly provide code execution. The primary impact is the compromise of confidentiality and availability of internal resources accessed by the server.", "risk_and_exploitability": "The CVSS base score of 5.0 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers need to be able to reach the Frigate server to send the /ffprobe request; this typically means a local network attacker or a publicly exposed Frigate instance. While the vulnerability does not grant arbitrary code execution, the ability to reach internal services can be leveraged for lateral movement or data exfiltration if other controls are weak."}}}}, "created": "2026-03-23T09:52:55.373089+00:00", "updated": "2026-03-25T14:34:50.563330+00:00", "vendors": ["blakeblackshear", "blakeblackshear$PRODUCT$frigate"]}