Live › vulnerability › CVE-2026-26980
Go to dashboardGhost, a Node.js content management system, has a blind SQL injection flaw in its Content API query parameters, affecting versions 3.24.0 through 6.19.0. An unauthenticated remote attacker can inject SQL commands to exfiltrate data from the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Sites running self-hosted Ghost between 3.24.0 and 6.19.0 with the Content API reachable from the internet are exposed, since the flaw needs no login. Teams on Ghost(Pro) managed hosting or on versions outside that range can skip it, though the sources do not state how the managed service was patched.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ghost | vendor | >= 3.24.0, < 6.19.1 | 6.19.1 |
ghost version or the ghost entry in package.json) and see whether it falls in 3.24.0 to 6.19.06.19.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-06-15 · Changelog
New updates and improvements at Cloudflare.
June 15, 2026
This week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic. These rules protect affected installations from unauthorized data exfiltration at the network edge.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...b4c29bc6 | N/A | Ghost CMS - SQLi - CVE:CVE-2026-26980 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...b56f403f | N/A | SQLi - Obfuscated Boolean - URI | Log | Disabled | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-26980")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.