Critical · published February 6, 2026
🚨 An admin can unwittingly hand over the keys to the kingdom! A critical Remote Command Execution (RCE) vulnerability in Frigate's integration with go2rtc allows malicious commands through the video stream configuration. 🔥 Think of your NVR as a hotel with a front desk. If the receptionist just lets anyone waltz in without checking ID, it's a recipe for disaster — anyone could walk right into your secure rooms and steal whatever they want! In the wrong hands, this vulnerability could lead to full administrative control over your Frigate installation, allowing attackers to execute arbitrary system commands. They could manipulate your NVR settings, access sensitive footage, or even take control of your network entirely. The consequences could be absolutely devastating!
Think of your NVR as a hotel with a front desk. If the receptionist just lets anyone waltz in without checking ID, it's a recipe for disaster — anyone could walk right into your secure rooms and steal whatever they want! This RCE vulnerability arises from improper input sanitization in the video stream configuration (config.yaml), enabling attackers to inject system commands via the exec: directive. Since the go2rtc service executes these commands without restrictions, any user with admin access could exploit this flaw.
In the wrong hands, this vulnerability could lead to full administrative control over your Frigate installation, allowing attackers to execute arbitrary system commands. They could manipulate your NVR settings, access sensitive footage, or even take control of your network entirely. The consequences could be absolutely devastating! Update your Frigate installation to version 0.16.4 or later immediately to close this vulnerability. Additionally, ensure that your Frigate setup is not exposed to the open internet without authentication to minimize risk. Regularly audit user permissions and access to enhance your security posture. You've got this! With a few swift updates, you can protect your network like a pro! 🛡️