CVE-2026-26980: Ghost has a SQL Injection in its Content API
Impact
A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database.
Vulnerable Versions
This vulnerability is present in Ghost v3.24.0 to v6.19.0.
Patches
v6.19.1 contains a fix for this issue.
Workarounds
There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.
As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing slug%3A%5B or slug:[ in the query string filter parameter. Note that this may break legitimate slug filter functionality.
References
We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly.
For more information If you have any questions or comments about this advisory, email us at security@ghost.org.
Other sources
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26980?
CVE-2026-26980 is classified as a high severity SQL injection vulnerability.
How do I fix CVE-2026-26980?
To fix CVE-2026-26980, upgrade Ghost to version 6.19.1 or later.
Which versions of Ghost are affected by CVE-2026-26980?
CVE-2026-26980 affects Ghost versions from 3.24.0 to 6.19.0.
What type of vulnerability is CVE-2026-26980?
CVE-2026-26980 is a SQL injection vulnerability that allows unauthorized data access from the database.
Can CVE-2026-26980 be exploited by unauthenticated users?
Yes, CVE-2026-26980 can be exploited by unauthenticated attackers.