v0.17.2
0.17.2 Release
Added 1
- Exports can optionally include recording segment information as chapters in mp4 metadata
Changed 3
- Performance improvements when displaying previews in the live page
- Offload preview encoding and Plus upload off the API event loop
- Allow non-admin users to use PTZ controls for cameras they have access to
Fixed 2
- Filter motion review by allowed cameras
- Fix cache control header for current hour preview mp4s
Security 6
- Fixed go2rtc WebSocket live stream camera access bypass for role-restricted users
- Fixed incomplete patch of CVE-2025-62382 regarding image_path backslash-separator bypass and arbitrary host-file read
- Fixed incomplete patch of CVE-2026-25643 regarding go2rtc exec:/echo:/expr: prefix block bypass allowing RCE and container escape
- Fixed RTSP credentials leak to viewer role via nginx proxy_cache
- Fixed authenticated admin RCE via go2rtc Stream API by enforcing exec: filter at API layer
- Fixed WebSocket missing authorization allowing viewer to execute admin-only operations
This is a maintenance release for Frigate 0.17 that includes fixes and minor changes.
Images
- ghcr.io/blakeblackshear/frigate:0.17.2
- ghcr.io/blakeblackshear/frigate:0.17.2-standard-arm64
- ghcr.io/blakeblackshear/frigate:0.17.2-tensorrt
- ghcr.io/blakeblackshear/frigate:0.17.2-rk
- ghcr.io/blakeblackshear/frigate:0.17.2-rocm
- ghcr.io/blakeblackshear/frigate:0.17.2-tensorrt-jp6
- ghcr.io/blakeblackshear/frigate:0.17.2-synaptics
What's Changed
Security Advisories
These advisories impact users with publicly exposed instances with no authentication and users with viewer roles where it is important to restrict access to some cameras.
Addressed in this release:
- go2rtc WebSocket live stream camera access bypass (role-restricted users)
- Incomplete patch of CVE-2025-62382:
image_pathbackslash-separator bypass ofpathvalidate.sanitize_filepath+startswith(CLIPS_DIR)reachesshutil.copyarbitrary host-file read - Incomplete patch of CVE-2026-25643: go2rtc exec:/echo:/expr: prefix block is bypassed when a stream value is a YAML mapping with a
urlkey (RCE + container escape) - RTSP credentials leak to viewer role via nginx proxy_cache
- Authenticated Admin Can Achieve RCE via go2rtc Stream API — exec: Filter Not Enforced at API Layer
- WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
To be addressed in future versions:
- Authenticated viewer can read /api/logs/frigate and /api/logs/nginx, exposing the auto-generated admin password and camera RTSP/ONVIF credentials (viewer-to-admin privilege escalation)
- Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
- Camera ACL bypass via Nginx static locations allows authenticated users to access recordings from unauthorized cameras
Notable Changes
- Exports can optionally include recording segment information as chapters in mp4 metadata
- Performance improvements when displaying previews in the live page
All Commits
- Update docs for DEIMv2 support by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/22598
- Add role-based auth to websocket message handler by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22710
- Update MemryX section documentation by @abinila4 in https://github.com/blakeblackshear/frigate/pull/22712
- Memryx docs update by @abinila4 in https://github.com/blakeblackshear/frigate/pull/22746
- Docs update by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22864
- Update restream.md docs and clarify output config by @Feni85 in https://github.com/blakeblackshear/frigate/pull/22860
- Fix broken docs links with hash fragments that resolve wrong on reload by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22925
- Fix yolonas colab notebook by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22936
- Fixes by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23235
- Add metadata for creation time in recordings / exports by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/23239
- Fix admin response cache leak to non-admin users via nginx proxy_cache by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23261
- Docs update by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23280
- Docs update by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23282
- Filter motion review by allowed cameras by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23294
- Add ability to control chapters set on MP4 Export by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/23310
- Chapter tweaks by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/23440
- Catch edge cases in security protections by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/23493
- Offload preview encoding and Plus upload off the API event loop by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23552
- Fix cache control header for current hour preview mp4s by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23553
- Allow non-admin users to use PTZ controls for cameras they have access to by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/23578
New Contributors
- @Feni85 made their first contribution in https://github.com/blakeblackshear/frigate/pull/22860
Full Changelog: https://github.com/blakeblackshear/frigate/compare/v0.17.1...v0.17.2