Ghost is a Node

CVE-2026-26980 is an unauthenticated SQL injection in Ghost CMS's Content API. The vulnerable range is Ghost 3.24.0 through 6.19.0, fixed in 6.19.1. The bug sits in slug filter ordering logic: attacker input was interpolated into a raw SQL fragment instead of bound safely, letting a remote attacker pull arbitrary data out of the Ghost database through the public content endpoint.

The vendor's CRITICAL 9.4 call is basically right in the real world. This is not just 'database read' in a vacuum: Ghost stores Admin API keys in that database, and those keys convert a read bug into authenticated site takeover for content, users, themes, and settings. The only meaningful downward pressure is that this is usually app-layer compromise rather than direct host RCE, but active exploitation across 700+ sites erases any temptation to downgrade it.

Why this verdict

• No-auth remote path: the bug is reachable over the public Content API with no login, no prior foothold, and no user interaction.
• Real-world amplification: XLab and downstream reporting show active exploitation and 700+ poisoned sites, so this is not a theoretical SQLi waiting for a lab PoC.
• Practical impact exceeds 'read-only': database access yields Ghost Admin API keys, which turns the flaw into authenticated content and site-management takeover.
• Exposure is broad where it matters: Ghost is a web CMS, so affected instances are commonly internet-facing rather than tucked behind an internal admin plane.
• Downward pressure exists but is limited: this usually compromises the Ghost application and its visitors, not necessarily the underlying host OS, so I am staying just under the vendor's maximum framing rather than pushing even higher.

Why not higher?

This is not a clean host-level RCE or hypervisor escape. The observed abuse path is app compromise through stolen Ghost admin keys, which is ugly and dangerous but still narrower than guaranteed server takeover across every deployment. Also, Ghost(Pro) was patched immediately, so the exploitable population is disproportionately self-hosted laggards rather than the entire Ghost ecosystem.

Why not lower?

Because the classic downgrade arguments do not hold here. It does not require internal access, credentials, or user interaction, and the exploitation chain has already been industrialized in the wild. A public-facing CMS flaw with live abuse and a direct path to site-admin capability is exactly what a CRITICAL bucket is for.

1. Block the known request pattern at the edge — Deploy a reverse-proxy or WAF rule to block or alert on Content API requests containing slug:[ or slug%3A%5B and related SQLi markers. Because there is active exploitation evidence, do this immediately, within hours rather than waiting for normal change windows.
2. Rate-limit and monitor the Content API — Apply aggressive rate limits and anomaly detection to /ghost/api/content/* to break blind extraction loops and surface repeated probing. This is a temporary brake, not a fix, and should be in place immediately, within hours for exposed instances.
3. Rotate Ghost admin-side secrets after patching — Assume exposed sites may have leaked Admin API keys, session secrets, and other database-resident credentials. Rotate them after patching to kill attacker reuse; with active exploitation on record, treat this as immediate post-patch work, within hours for known or suspected exposed sites.
4. Inspect content and admin activity for silent site poisoning — Review published posts, themes, code injection areas, and Admin API activity for malicious JavaScript or unauthorized content changes. The observed campaign used legitimate app-level admin functionality, so this investigation should begin immediately, within hours on vulnerable internet-facing sites.
5. Constrain exposure where business permits — If the Content API does not need unrestricted internet access, place it behind allowlists, a CDN rule set, or another access-control layer. That will not cure the vulnerable code, but it reduces reachable population and should be implemented within the CRITICAL remediation cycle, with emergency controls applied first.

Run this on the Ghost host as a user who can read the installation directory; root is not required unless permissions are locked down. Save it as check-ghost-cve-2026-26980.sh, then run bash check-ghost-cve-2026-26980.sh /var/www/ghost or point it directly at your Ghost install root.

#!/usr/bin/env bash
# check-ghost-cve-2026-26980.sh
# Detects whether a local Ghost installation falls in the vulnerable range for CVE-2026-26980.
# Usage: bash check-ghost-cve-2026-26980.sh /path/to/ghost
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

ROOT="${1:-/var/www/ghost}"

CANDIDATES=(
  "$ROOT/current/package.json"
  "$ROOT/current/core/package.json"
  "$ROOT/package.json"
)

PACKAGE_JSON=""
for f in "${CANDIDATES[@]}"; do
  if [ -r "$f" ]; then
    PACKAGE_JSON="$f"
    break
  fi
done

if [ -z "$PACKAGE_JSON" ]; then
  echo "UNKNOWN: could not find readable Ghost package.json under $ROOT"
  exit 2
fi

VERSION=$(sed -n 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"\([^"]\+\)".*/\1/p' "$PACKAGE_JSON" | head -n1)
VERSION="${VERSION#v}"

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: could not parse Ghost version from $PACKAGE_JSON"
  exit 2
fi

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$1" != "$2" ] && [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

LOWER="3.24.0"
UPPER="6.19.1"

if version_ge "$VERSION" "$LOWER" && version_lt "$VERSION" "$UPPER"; then
  echo "VULNERABLE: Ghost $VERSION detected at $PACKAGE_JSON (affected range: >= $LOWER and < $UPPER)"
  exit 1
fi

if version_ge "$VERSION" "$UPPER" || version_lt "$VERSION" "$LOWER"; then
  echo "PATCHED: Ghost $VERSION detected at $PACKAGE_JSON (not in affected range)"
  exit 0
fi

echo "UNKNOWN: Ghost $VERSION detected, but comparison logic could not classify it"
exit 2

Sources

1. NVD CVE record
2. Ghost vendor forum advisory
3. GitHub advisory via OSV mirror
4. Ghost fix commit
5. QiAnXin XLab exploitation report
6. BleepingComputer exploitation coverage
7. Check Point IPS advisory
8. CISA KEV catalog