CVE-2026-26980

nvd.nist.gov • May 24, 2026

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Ghost CMS Exploited CVE-2026-26980 is a SQL Injection vulnerability affecting Ghost, a Node.js content management system, allowing unauthenticated attackers to perform arbitrary database reads. The flaw exists in the Content API's slug filter ordering functionality, impacting versions 3.24.0 through 6.19.0. Attackers can exploit this vulnerability without authentication, potentially compromising sensitive user data, including credentials and API keys. The vulnerability was published on February 20, 2026, with a proof of concept released on March 30, 2026. Ghost has released a patch in version 6.19.1, which implements parameterized queries to mitigate the risk. Security professionals are advised to update to the latest version immediately to prevent exploitation. The vulnerability is particularly dangerous due to its ease of exploitation over the network. 2 sources 72

Extracted Entities

CVE-2026-26980

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)