# Frigate v0.17.2 — 0.17.2 Release

- Product: Frigate (https://whatsnew.fyi/product/frigate)
- Vendor: Frigate
- Date: 2026-06-28
- Version: v0.17.2
- Original notes: https://github.com/blakeblackshear/frigate/releases/tag/v0.17.2
- Permalink: https://whatsnew.fyi/product/frigate/releases/v0.17.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed go2rtc WebSocket live stream camera access bypass for role-restricted users
- **security** — Fixed incomplete patch of CVE-2025-62382 regarding image_path backslash-separator bypass and arbitrary host-file read
- **security** — Fixed incomplete patch of CVE-2026-25643 regarding go2rtc exec:/echo:/expr: prefix block bypass allowing RCE and container escape
- **security** — Fixed RTSP credentials leak to viewer role via nginx proxy_cache
- **security** — Fixed authenticated admin RCE via go2rtc Stream API by enforcing exec: filter at API layer
- **security** — Fixed WebSocket missing authorization allowing viewer to execute admin-only operations
- **added** — Exports can optionally include recording segment information as chapters in mp4 metadata
- **changed** — Performance improvements when displaying previews in the live page
- **changed** — Offload preview encoding and Plus upload off the API event loop
- **fixed** — Filter motion review by allowed cameras
- **fixed** — Fix cache control header for current hour preview mp4s
- **changed** — Allow non-admin users to use PTZ controls for cameras they have access to

This is a maintenance release for Frigate 0.17 that includes fixes and minor changes.

##### Images

- [ghcr.io/blakeblackshear/frigate:0.17.2](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/982004562?tag=0.17.2)
- [ghcr.io/blakeblackshear/frigate:0.17.2-standard-arm64](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/981112840?tag=0.17.2-standard-arm64)
- [ghcr.io/blakeblackshear/frigate:0.17.2-tensorrt](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/982014308?tag=0.17.2-tensorrt)
- [ghcr.io/blakeblackshear/frigate:0.17.2-rk](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/981127205?tag=0.17.2-rk)
- [ghcr.io/blakeblackshear/frigate:0.17.2-rocm](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/982027592?tag=0.17.2-rocm)
- [ghcr.io/blakeblackshear/frigate:0.17.2-tensorrt-jp6](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/981119391?tag=0.17.2-tensorrt-jp6)
- [ghcr.io/blakeblackshear/frigate:0.17.2-synaptics](https://github.com/blakeblackshear/frigate/pkgs/container/frigate/981125957?tag=0.17.2-synaptics)

##### What's Changed

###### Security Advisories

These advisories impact users with publicly exposed instances with no authentication and users with viewer roles where it is important to restrict access to some cameras.

Addressed in this release:

- [go2rtc WebSocket live stream camera access bypass (role-restricted users)](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-hh3j-7g2f-43j2)
- [Incomplete patch of CVE-2025-62382: `image_path` backslash-separator bypass of `pathvalidate.sanitize_filepath` + `startswith(CLIPS_DIR)` reaches `shutil.copy` arbitrary host-file read](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-pqfr-m69j-4mq2)
- [Incomplete patch of CVE-2026-25643: go2rtc exec:/echo:/expr: prefix block is bypassed when a stream value is a YAML mapping with a `url` key (RCE + container escape)](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-r57j-5jm9-hpcc)
- [RTSP credentials leak to viewer role via nginx proxy_cache](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-4vfc-hxpj-f7x7)
- [Authenticated Admin Can Achieve RCE via go2rtc Stream API — exec: Filter Not Enforced at API Layer](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-wwww-5h25-jf98)
- [WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-r5fm-h944-8chq)

To be addressed in future versions:

- [Authenticated viewer can read /api/logs/frigate and /api/logs/nginx, exposing the auto-generated admin password and camera RTSP/ONVIF credentials (viewer-to-admin privilege escalation)](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-c4qf-xxq4-vf55)
- [Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr)
- [Camera ACL bypass via Nginx static locations allows authenticated users to access recordings from unauthorized cameras](https://github.com/blakeblackshear/frigate/security/advisories/GHSA-74x4-gw64-2mq5)

###### Notable Changes

- Exports can optionally include recording segment information as chapters in mp4 metadata
- Performance improvements when displaying previews in the live page

###### All Commits
* Update docs for DEIMv2 support by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/22598
* Add role-based auth to websocket message handler by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22710
* Update MemryX section documentation by @abinila4 in https://github.com/blakeblackshear/frigate/pull/22712
* Memryx docs update by @abinila4 in https://github.com/blakeblackshear/frigate/pull/22746
* Docs update by @hawkeye217 in https://github.com/blakeblackshear/frigate/p

_[Truncated at 4000 characters — full notes: https://github.com/blakeblackshear/frigate/releases/tag/v0.17.2]_