CVE-2026-70595: Ghost Package Server-Side Request Forgery Mitigation Issue
Summary
CVE-2026-70595: Ghost: Server-Side Request Forgery Mitigation Issue. Affects ghost versions >= 6.26.0, < 6.54.1. Fixed in 6.54.1. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-70595 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular Node.js content management system designed for professional publishing. It provides a user-friendly interface for creating and managing content, with features such as customizable themes, built-in SEO tools, and support for various integrations. However, certain versions of Ghost (from 6.26.0 to 6.54.1) have a vulnerability that allows unauthenticated users to exploit specific functionalities, leading to potential security risks.
Vulnerability Detail
The vulnerability in Ghost arises from a validation issue that permits unauthenticated users to exploit functionalities like Webmentions. This exploitation allows these users to make limited HTTP requests to internal network hosts of the Ghost server. Although a successful attack does not return any response data, it poses a risk of exposing internal services and could lead to further attacks if not mitigated. The vulnerability has been identified in versions 6.26.0 through 6.54.1.
How To Fix
Minimum fixed version
6.54.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Ghost server by implementing firewall rules or network policies that limit incoming requests to trusted IP addresses only. This will help mitigate the risk until the package is updated.
Conclusion
In summary, CVE-2026-70595 is a significant vulnerability in the Ghost content management system that allows unauthenticated users to exploit certain functionalities. It is crucial to update to version 6.54.1 or later to mitigate this risk. Implementing temporary workarounds can help protect your system until the update is applied.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-70595 is a vulnerability in the Ghost content management system that allows unauthenticated users to exploit certain functionalities to make limited HTTP requests to internal network hosts.
Versions of Ghost from 6.26.0 to 6.54.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Ghost immediately, consider implementing firewall rules or network policies to restrict access to the Ghost server until you can apply the patch.
The potential risks include unauthorized access to internal services, which could lead to further exploitation or data breaches if the vulnerability is not addressed.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
