Frigate NVR Updates: Closing Config Paths to Root Execution
Weekend work focused on security hardening to block command execution and privilege escalation through configuration, alongside honest Frigate+ key validation and smaller build improvements.
Duration: PT2M14S
Episode overview
This episode is a short developer briefing from Frigate NVR Updates.
It explains recent repository work in plain language.
- Show: Frigate NVR Updates
- Published: 2026-11-09T14:14:52Z
- Audio duration: PT2M14S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's Monday, November 9th, 2026, and this is Frigate NVR Updates.
The lead story is security: two related fixes close ways a crafted configuration could turn into command execution or root access.
The first theme is locking down streaming and environment handling, in PR 24890. The internal web socket port previously granted admin access before checking stream sources, allowing an unknown source to start a media server producer, including FFmpeg sources with raw arguments. It now rejects unknown sources like…
Closely related is PR 24891, which stops running a configured FFmpeg binary as root. Previously the startup version check ran with elevated privileges before dropping to the service user, so a writable config directory could plant a replacement binary and gain root on restart. The check now runs as the unprivileged…
The second theme is more honest Frigate Plus validation, in PR 24918 and commit 81cf7be. The settings page reported a key as validated on format alone. There's now an on-demand Validate with Frigate Plus button backed by a new admin-only endpoint that distinguishes valid, invalid, unreachable, and not set, without…
Finally, miscellaneous fixes in PR…
Nearby episodes from Frigate NVR Updates
- Debug Replay and AI Review Reliability
- Traceable AI Requests and Autotracking Fixes
- Startup Hardening and Detector Efficiency
- Weekly Recap - Security Hardening and Leaner AI
- Security Hardening and Load Stability
- Opt-In Analytics, Notification Control, and Pipeline Fixes
- GenAI Freeze Fix and Autotrack Hardening
- OpenAI Blocking Fix