Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33126Frigate has SSRF vulnerability in /ffprobe endpoint

Medium 5.0

In plain English

A medium-severity server-side request forgery in frigate from blakeblackshear. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 89.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.

Affected products (as reported)

Vendor	Product	Versions
blakeblackshear	frigate	< 0.16.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

References

https://github.com/blakeblackshear/frigate/security/advisories/GHSA-j6g3-3j3q-c2xv x_refsource_CONFIRM
https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3 x_refsource_MISC