ETK-2026-1734Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1734",
  "cve_id": null,
  "display_id": "ETK-2026-1734",
  "ghsa_id": "GHSA-qjjw-3v66-279f",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Admin command execution in Frigate go2rtc stream handling",
  "summary": "Frigate versions before 0.18.2 do not adequately restrict certain go2rtc stream sources. An authenticated administrator can use the bypass to cause commands to execute as root inside the Frigate container.",
  "mitigation": "Upgrade blakeblackshear/frigate to >=0.18.2 or later.",
  "vendor": null,
  "product": "blakeblackshear/frigate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.18.0, <= 0.18.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        ">=0.18.2"
      ],
      "package_name": "blakeblackshear/frigate",
      "purl": null
    }
  ],
  "cwes": [
    184
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.149017566666668,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T22:40:50+00:00",
      "days": -5.2573644266550925,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:26.308691+00:00",
      "url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-qjjw-3v66-279f"
    }
  }
}