CVE-2026-70595: Ghost Package Server-Side Request Forgery Mitigation Issue
Summary
CVE-2026-70595: Ghost: Server-Side Request Forgery Mitigation Issue. Affects ghost versions >= 6.26.0, < 6.54.1. Fixed in 6.54.1. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-70595 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing blogs and websites. It offers a user-friendly interface, supports various themes and plugins, and is built on Node.js. However, like many web applications, Ghost can be vulnerable to security issues, including server-side request forgery (SSRF), which can allow unauthorized access to internal resources.
Vulnerability Detail
The vulnerability identified as CVE-2026-70595 is a server-side request forgery (SSRF) issue in the Ghost package. This flaw arises from inadequate validation, enabling unauthenticated users to exploit certain functionalities, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network. Although a successful attack does not return any response data, it poses a risk of exposing internal services to unauthorized access.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.54.1
This is the first release that contains the fix.
npm install ghost@6.54.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
In summary, CVE-2026-70595 is a server-side request forgery vulnerability in the Ghost package that can be exploited by unauthenticated users. Users are urged to update to version 6.54.1 or later to mitigate this risk. Regular monitoring and updating of open-source packages are crucial for maintaining security.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-70595 is a vulnerability in the Ghost package that allows unauthenticated users to exploit certain functionalities to make limited HTTP requests to internal network hosts.
The vulnerability affects Ghost versions from 6.26.0 up to 6.54.0.
You can check your Ghost version and compare it to the affected versions. Additionally, you can use Vulert to monitor and alert for vulnerabilities in your software.
While there are no specific workarounds, it is highly recommended to prioritize updating to the patched version to mitigate the risk.
Ghost thanks Hwang Seyeon for responsibly disclosing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
