Frigate, the open-source NVR that many Home Assistant users run for local object detection on their cameras, released version 0.18.2 late on 15 October 2026 (UTC). It fixes three security flaws published the same evening, two of them rated critical. Both critical bugs affect only 0.18.0 and 0.18.1. The Frigate add-on for Home Assistant moved to 0.18.2 a few minutes after the release.
From viewer to root
The worse of the two, GHSA-93xj-hg88-ffg7, scores 9.9 on CVSS 3.1. Three live-view routes, /live/mse/api/ws, /live/webrtc/api/ws and /api/go2rtc/webrtc, go from nginx straight to go2rtc's API and skip the filter Frigate uses to block stream sources that run commands. The only check left on them is a per-camera role restriction. On a default install the built-in viewer role has an empty camera list, which Frigate reads as "all cameras", so that check never runs. According to the advisory, any logged-in account, including a freshly created viewer, can open a websocket with an ffmpeg: source and run commands as root inside the container.
The second critical flaw, GHSA-qjjw-3v66-279f (CVSS 9.1), needs an admin account. The denylist added after CVE-2026-25643 blocked echo:, expr: and exec: stream sources but not ffmpeg:, which go2rtc expands internally into exec: with arguments the attacker controls. An admin could register such a stream and trigger it through the snapshot endpoint, again getting root in the container. The advisory points out that Frigate's documented deployment runs the container as privileged: true with host paths mounted, which makes escaping the container a realistic next step.
The third fix, GHSA-3cxh-fj2f-h497 (medium, 6.5), matters if you limit some users to certain cameras. The auth check looked at the raw request path, while nginx normalises the path before choosing what to serve. A crafted path such as //clips/... or /./clips/... let a restricted user read other cameras' clips, snapshots, recordings and exports and open their live streams. One of the three variants was a regression introduced by a fix in 0.18.1.
0.18.1 came two days earlier
Version 0.18.1, released on 13 October, had already closed three medium-severity holes. A camera named like an API namespace (faces, lpr, audio or classification) switched off the admin check for those endpoints, so a viewer could read the face registry and add face-training data. A fragment in the Host header bypassed authorisation for media and go2rtc. And any logged-in user could store a malformed push-notification subscription that crashed Frigate on every start. The same release cut Intel QSV CPU usage for cameras with a high frame rate and backs off restarts when a recording stream goes stale.
What to do
Update to 0.18.2: pull ghcr.io/blakeblackshear/frigate:0.18.2, or the variant for your detector, or update the add-on in Home Assistant. If you cannot update straight away, check who has an account, viewers included, because the 9.9 bug needs nothing more than a login. Keeping Frigate's web interface off the open internet narrows who can try at all.