CVE-2026-25643
Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc.
Does this matter?
A public exploit is published in Exploit-DB and the impact is critical, while EPSS rates exploitation at 3.0%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use.
Description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 3.03% probability · 87th percentile
- Public exploits
- 1 in Exploit-DB · first 30 April 2026
- CISA KEV
- Not listed
- Weakness
- CWE-78, CWE-250, CWE-269, CWE-668
- Affected
- frigate/frigate
- Source
- security-advisories@github.com
EPSS moved from 3.0% on 25 October 2026 to 3.0% on 26 October 2026.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://github.com/blakeblackshear/frigate/releases/tag/v0.16.4Release Notes
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6xExploit, Vendor Advisory
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6xExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.