CVE-2026-25643: Frigate NVR - OS command injection via go2rtc exec directive
Frigate versions before 0.16.4 contain a critical OS command injection flaw in the go2rtc integration, reachable through the exec directive in the video stream configuration. The record gives a CVSS 3.1 base score of 9.1 and states that exploitation requires an administrator or an internet-exposed installation without authentication. The record states 0.16.4 as the fixed version, and no confirmed exploitation appears in the sources consulted.
Overview
Frigate is a network video recorder with local object detection for IP cameras. According to the GitHub advisory referenced in the record, versions before 0.16.4 contain a critical command injection flaw in the integration with go2rtc, a streaming component. User-supplied values in the video stream configuration (config.yaml) are not sanitized, so specially formed entries can be interpreted as system commands through the exec directive.
Impact
- The record assigns a CVSS 3.1 base score of 9.1 (critical), with high confidentiality, integrity and availability impact and a scope change.
- Successful exploitation would allow operating system commands to run without restriction through the go2rtc service, as described in the advisory summary.
- The description states that the flaw is exploitable by an administrator, or by anyone who exposed an installation to the internet without authentication, which would grant full administrative control.
Affected products and versions
- The record lists the product as Frigate, with versions prior to 0.16.4 affected.
- The record states that the issue is fixed in version 0.16.4. Its structured fixes list is empty, so the release notes linked in the references are the fix reference available in the record.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog, so no active exploitation is reported from that source. No confirmed exploitation appears in the sources consulted. The GitHub advisory reference carries an Exploit tag in the record, but its content was not reviewed beyond that tag. The EPSS probability in the record is an statistical estimate and is not evidence of exploitation.
Remediation and mitigation
- Upgrade Frigate to version 0.16.4 or later, as indicated by the release referenced in the record.
- Until the upgrade is applied, do not expose the Frigate interface directly to the internet, and enforce authentication on all access paths.
- Limit administrative accounts to trusted personnel and restrict who can edit the configuration file.
- Review the go2rtc stream configuration for entries that were not added by administrators.
Detection guidance
- Audit config.yaml and stream definitions for exec directives or unfamiliar entries.
- Review access logs for unauthenticated requests to the Frigate web interface from external addresses.
- Confirm the installed version and identify any instance running a version below 0.16.4.
Limitations of the available information
- The record does not describe the exact input format, the technical root cause in code, or how many installations are exposed.
- The record does not state whether authentication is enabled by default in affected releases.
- The record contains no proof-of-concept details, and this analysis does not add any.
- Information beyond the advisory summary and the linked release was not available in the record.
Frequently asked questions
Which Frigate versions are affected by CVE-2026-25643?
The record lists Frigate versions prior to 0.16.4 as affected. The record states that the issue is fixed in 0.16.4.
Is this vulnerability confirmed as actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record gives an EPSS estimate, which is not evidence of exploitation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.