BIT-ghost-2026-25552: Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Q: Which deployments are exposed?

Self-hosted Ghost instances using Ghost CLI versions before 1.30.1 are exposed when Nginx is misconfigured in a way that lets attacker-controlled X-Forwarded-For values be appended through $proxy_add_x_forwarded_for. The provided information does not establish that a default Nginx configuration is affected.

Q: What does an attacker need to exploit this issue?

An attacker can act remotely and does not need authentication or user interaction. Exploitation requires the ability to manipulate the X-Forwarded-For header chain through the affected Nginx configuration.

Q: How can I determine whether an instance is affected?

Check whether Ghost CLI is earlier than 1.30.1 and review the Nginx configuration for use of $proxy_add_x_forwarded_for in a configuration that allows client-supplied X-Forwarded-For values to be appended. Affected configurations can allow arbitrary IP values to be presented to Ghost's rate-limiting mechanisms.

Published Jul 31, 2026

Updated

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxyaddxforwardedfor directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.

Affected Software

1 affected component

Ghost Ghost CLI<1.30.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ghost CLI to a version that resolves this vulnerability.
Fixed in 1.30.1

Event History

Jul 31, 2026

CVE Published

via OSV·06:12 PM

Data Sourced

via OSV·06:12 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Self-hosted Ghost instances using Ghost CLI versions before 1.30.1 are exposed when Nginx is misconfigured in a way that lets attacker-controlled X-Forwarded-For values be appended through $proxy_add_x_forwarded_for. The provided information does not establish that a default Nginx configuration is affected.

What does an attacker need to exploit this issue?

An attacker can act remotely and does not need authentication or user interaction. Exploitation requires the ability to manipulate the X-Forwarded-For header chain through the affected Nginx configuration.

How can I determine whether an instance is affected?

Check whether Ghost CLI is earlier than 1.30.1 and review the Nginx configuration for use of $proxy_add_x_forwarded_for in a configuration that allows client-supplied X-Forwarded-For values to be appended. Affected configurations can allow arbitrary IP values to be presented to Ghost's rate-limiting mechanisms.

BIT-ghost-2026-25552: Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether an instance is affected?