CVE-2026-26980

Description

### Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. ### Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. ### Patches v6.19.1 contains a fix for this issue. **Note:** as this vulnerability lets an attacker gain access to a site's API keys, we recommend reviewing staff users and rotating keys. We generally recommend always updating Ghost to its most current version. ### Workarounds There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability. As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing `slug%3A%5B` or `slug:[` in the query string filter parameter. Note that this may break legitimate slug filter functionality. ### References We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly. ### For more information If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).

How to fix CVE-2026-26980

To remediate CVE-2026-26980, upgrade the affected package to a fixed version below.

—upgrade to 6.19.1 or later
—upgrade to 6.19.1 or later

Is CVE-2026-26980 being exploited?

Likely — EPSS is 56.7%, placing CVE-2026-26980 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (2)

>= 3.24.0, < 6.19.1
>= 3.24.0, < 6.19.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L