CVE-2026-25643

Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

State: Published
Severity: 9.1 Critical
Published: Feb 6, 2026
Updated: Feb 6, 2026
Reserved: Feb 4, 2026

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-250 Execution with Unnecessary Privileges
CWE-269 Improper Privilege Management
CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

Product	Versions
frigateblakeblackshear	< 0.16.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.