CVE-2026-54652: Frigate 0.17.1 Privilege Escalation via Log Exposure

Technical summary

CVE-2026-54652 affects the GET /api/logs/{service} endpoint in Frigate 0.17.1. The endpoint implements insufficient access controls, permitting any authenticated user holding the viewer role to retrieve Frigate and nginx logs without additional authorization checks. The logs contain plaintext credentials including auto-generated administrative passwords and camera credentials that were logged as part of HTTP query strings. This stems from inadequate log scrubbing and overly permissive endpoint authorization, creating a direct path for privilege escalation from viewer to admin via credential extraction.

Business impact

This vulnerability directly compromises the security posture of Frigate deployments by enabling unauthorized credential disclosure. Organizations using Frigate for surveillance risk exposure of administrative accounts and camera access credentials to any employee or contractor with viewer permissions. Attackers holding low-privilege accounts can escalate to full administrative control, potentially allowing them to reconfigure the system, modify recordings, disable alerts, or pivot further into connected network infrastructure. The absence of a patched release means affected deployments remain vulnerable until an official fix is released.

Affected systems

Frigate 0.17.1 is confirmed affected. The vendor has not identified a fixed release as of the publication date. Organizations running Frigate should verify their installed version against version 0.17.1. If you are running Frigate in any capacity, check your version number immediately. Verify against the official Frigate release notes and GitHub repository to confirm whether any subsequent versions have been released that address this issue.

Exploitability

The vulnerability requires authentication (viewer-level credentials) and network access to the Frigate API endpoint. No user interaction is required once authenticated. The attack is trivial to execute—a viewer-level user simply needs to construct a GET request to /api/logs/{service} to download logs containing sensitive credentials. The low complexity and straightforward nature of exploitation, combined with the low barrier to entry (viewer role is typically the most permissive user level), makes this highly exploitable in environments where multiple users have viewer access.

Remediation

No patched version has been announced. Immediate compensating controls are essential: restrict network access to the /api/logs/{service} endpoint to administrative users only via firewall or reverse proxy rules; implement API gateway authentication that validates user role authorization before permitting log downloads; disable log query string logging in nginx to prevent credential capture; and rotate all credentials that may have been logged. Monitor the official Frigate GitHub repository and release notes for a security patch. Once available, apply the patched version immediately.

Patch guidance

A fixed release has not been identified as of July 2026. Monitor the Frigate GitHub repository (github.com/blakeblackshear/frigate) for security advisories and release announcements. Check the Issues and Releases sections regularly for updates addressing CVE-2026-54652. When a patch is released, test it in a non-production environment before deployment to ensure compatibility with your configuration and connected cameras. Apply the patch to all Frigate instances without delay once available.

Detection guidance

Monitor access logs for GET requests to /api/logs/ endpoints, particularly those from low-privilege user accounts. Establish a baseline of legitimate log access patterns and alert on anomalous requests such as batch downloads or repeated queries from unexpected users. Check Frigate application logs and nginx access logs for signs of log retrieval activity. Conduct a credential audit: if you suspect unauthorized log access, rotate all admin passwords and camera credentials immediately and review authentication records for unauthorized escalation attempts. Log monitoring should capture the requesting user identity and timestamp to correlate with potential follow-up activities.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity (CVSS 8.1), authentication requirement that enables insider threat scenarios, direct credential exposure, and the absence of a patch. The combination of low exploitability barrier, high-impact consequence (privilege escalation to admin), and widespread exposure risk (any viewer-level user) makes it a priority for remediation or compensating control deployment. Organizations should prioritize restricting endpoint access while awaiting a patch.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: low attack complexity and low privileges required (viewer-level access is commonly granted), no user interaction needed, network-accessible endpoint, and high confidentiality and integrity impact (credential exposure enables privilege escalation). The absence of availability impact (logged credentials do not cause system downtime) prevents a critical rating. However, the real-world severity is amplified by the lack of a patch, making compensating controls time-sensitive.

Frequently asked questions