CVE-2026-25643
📋 TL;DR
CVE-2026-25643 is a critical Remote Command Execution vulnerability in Frigate NVR software that allows attackers to execute arbitrary system commands via unsanitized input in video stream configuration. Only administrators or users who expose Frigate to the internet without authentication are affected. The vulnerability stems from improper input sanitization in the exec: directive of config.yaml.
💻 Affected Systems
- Frigate NVR
📦 What is this software?
Frigate by Frigate
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, install malware, exfiltrate data, or pivot to other network systems.
Likely Case
Attackers gaining shell access to the Frigate host system, potentially compromising the entire NVR system and connected cameras.
If Mitigated
No impact if proper authentication is enabled and the system is not exposed to untrusted networks.
🎯 Exploit Status
Exploitation requires access to modify config.yaml, which typically requires administrative access or exposure without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.16.4
Vendor Advisory: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4c97-5jmr-8f6x
Restart Required: Yes
Instructions:
1. Backup your config.yaml. 2. Stop Frigate service. 3. Update to version 0.16.4 using your package manager or manual installation. 4. Restart Frigate service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable exec directive
allRemove or comment out any exec: directives in config.yaml to prevent command injection.
# Edit config.yaml and remove lines containing 'exec:'
Enable authentication
allConfigure Frigate authentication to prevent unauthorized access to configuration.
# Configure authentication in Frigate settings
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to prevent external access to Frigate.
- Enable authentication and use strong credentials if Frigate must be accessible.
🔍 How to Verify
Check if Vulnerable:
Check if Frigate version is below 0.16.4 and if config.yaml contains exec: directives.Check Version:
docker exec frigate cat /VERSION 2>/dev/null || grep version /config/config.yamlVerify Fix Applied:
Verify Frigate version is 0.16.4 or higher and test that exec: directives are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Unauthorized modifications to config.yaml
- Unexpected processes spawned by Frigate
Network Indicators:
- Unusual outbound connections from Frigate host
- Suspicious traffic to/from Frigate web interface
SIEM Query:
process.name:sh OR process.name:bash AND parent.name:frigate OR parent.name:go2rtc