{"id":"CVE-2026-26980","kind":"vulnerability","aliases":["CVE-2026-26980"],"related":[],"title":"Ghost CMS: unauthenticated blind SQL injection in Content API","description":"WAF Release - 2026-06-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJune 15, 2026\n\n## WAF Release - 2026-06-15\n\nThis week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic. These rules protect affected installations from unauthorized data exfiltration at the network edge.\n\nKey Findings\n\n- CVE-2026-26980: A blind SQL injection vulnerability in the Ghost CMS Content API (versions 3.24.0 to 6.19.0) allows unauthenticated remote attackers to inject malicious SQL commands via query parameters due to improper input validation.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...b4c29bc6 | N/A | Ghost CMS - SQLi - CVE:CVE-2026-26980 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...b56f403f | N/A | SQLi - Obfuscated Boolean - URI | Log | Disabled | This is a new detection. |","summary":"Ghost, a Node.js content management system, has a blind SQL injection flaw in its Content API query parameters, affecting versions 3.24.0 through 6.19.0. An unauthenticated remote attacker can inject SQL commands to exfiltrate data from the database.","severity":"critical","cvss":9.4,"epss":0.05573,"exploited":false,"exploited_at":null,"products":[{"name":"ghost","fixed":["6.19.1"],"affected":">= 3.24.0, < 6.19.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","cms","ghost","lab-disclosure","node.js","self-hosted","vendor"],"not_affected_if":["managed-hosting","version-outside-range"],"how_to_check":"- Check the installed Ghost version (for example with `ghost version` or the `ghost` entry in `package.json`) and see whether it falls in `3.24.0` to `6.19.0`\n- Confirm whether the Content API is exposed to the internet on the site\n- unknown for any other check the sources do not describe","fix":"- Upgrade Ghost to `6.19.1` or later\n- If upgrading is not possible right away, the Cloudflare WAF managed rule 'Ghost CMS - SQLi - CVE:CVE-2026-26980' blocks the attack at the network edge\n- unknown for other mitigations the sources do not describe","status":"open","published_at":"2026-02-20T02:16:54+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:17+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T05:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ghost to `6.19.1` or later\n- If upgrading is not possible right away, the Cloudflare WAF managed rule 'Ghost CMS - SQLi - CVE:CVE-2026-26980' blocks the attack at the network edge\n- unknown for other mitigations the sources do not describe","reach":"internet","title":"Ghost CMS: unauthenticated blind SQL injection in Content API","impact":"high","summary":"Ghost, a Node.js content management system, has a blind SQL injection flaw in its Content API query parameters, affecting versions 3.24.0 through 6.19.0. An unauthenticated remote attacker can inject SQL commands to exfiltrate data from the database.","category":"vendor","nicknames":[],"who_cares":["ghost","self-hosted","node.js","cms"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker reads database contents, including member and staff data.","analyst_note":"Confirm the fixed version and any managed-hosting status from the Ghost security advisory; the NVD and Ghost pages were listed as sources but their text was not provided.","how_to_check":"- Check the installed Ghost version (for example with `ghost version` or the `ghost` entry in `package.json`) and see whether it falls in `3.24.0` to `6.19.0`\n- Confirm whether the Content API is exposed to the internet on the site\n- unknown for any other check the sources do not describe","needs_analyst":true,"not_affected_if":["managed-hosting","version-outside-range"],"who_is_affected":"Sites running self-hosted Ghost between 3.24.0 and 6.19.0 with the Content API reachable from the internet are exposed, since the flaw needs no login. Teams on Ghost(Pro) managed hosting or on versions outside that range can skip it, though the sources do not state how the managed service was patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000725,"input_tokens":3794,"output_tokens":692,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-06':68C,84C '-15':69C,85C '-2026':11A,14A,105C,143C,199C '-26980':12A,15A,106C,144C,200C '15':79C '2026':67C,80C,83C '3.24.0':48B,157C '6.19.0':50B,159C 'action':185C,187C 'address':95C 'affect':46B,130C 'allow':160C 'api':9A,43B,155C 'attack':54B,163C 'attempt':122C 'b4c29bc6':192C 'b56f403f':211C 'blind':4A,36B,146C 'block':116C,202C 'boolean':125C,215C 'bypass':121C 'changelog':70C,71C 'cloudflar':17B,77C,189C,208C 'cms':2A,18B,103C,153C,195C 'command':58B,168C 'comment':188C 'content':8A,31B,42B,154C 'critic':97C 'cve':10A,13A,104C,142C,197C,198C 'data':61B,134C 'databas':64B 'descript':183C 'design':112C 'detect':207C,223C 'disabl':218C 'disclosur':22B 'due':172C 'edg':139C 'exfiltr':60B,135C 'find':141C 'flaw':39B 'generic':110C 'ghost':1A,16A,19B,28B,102C,152C,194C 'host':26B 'id':179C,182C 'identifi':114C 'improp':174C 'improv':75C 'inject':6A,38B,56B,99C,119C,148C,165C 'input':175C 'instal':131C 'introduc':90C 'june':78C 'key':140C 'lab':21B 'lab-disclosur':20B 'legaci':180C 'leverag':123C 'log':201C,217C 'logic':126C 'malici':166C 'manag':32B,92C,190C,209C 'n/a':193C,212C 'network':138C 'new':72C,91C,109C,186C,206C,222C 'node.js':23B,30B 'obfusc':124C,214C 'paramet':45B,171C 'previous':184C 'protect':93C,129C 'queri':44B,170C 'releas':66C,82C,89C 'remot':53B,162C 'rule':111C,128C,178C,181C 'ruleset':177C,191C,210C 'self':25B 'self-host':24B 'sophist':117C 'sql':5A,37B,57B,98C,118C,147C,167C 'sqli':120C,196C,213C 'system':33B 'unauthent':3A,52B,161C 'unauthor':133C 'updat':73C 'uri':216C 'valid':176C 'vendor':27B 'version':47B,156C 'via':169C 'vulner':100C,149C 'waf':65C,81C 'week':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running self-hosted Ghost between 3.24.0 and 6.19.0 with the Content API reachable from the internet are exposed, since the flaw needs no login. Teams on Ghost(Pro) managed hosting or on versions outside that range can skip it, though the sources do not state how the managed service was patched.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-20T02:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-06-15-waf-release/#CVE-2026-26980","url":"https://developers.cloudflare.com/changelog/post/2026-06-15-waf-release/","severity":null,"published_at":"2026-06-15T18:55:56+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF Release - 2026-06-15 · Changelog"},{"source":"nvd","external_id":"CVE-2026-26980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26980","severity":null,"published_at":"2026-02-20T02:16:54+00:00","modified_at":"2026-06-17T10:26:28+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-26980","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26980","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2903,"url":"https://developers.cloudflare.com/changelog/post/2026-06-15-waf-release/","title":"Cloudflare: WAF Release - 2026-06-15 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-06-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJune 15, 2026\n\n## WAF Release - 2026-06-15\n\nThis week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic. These rules protect affected installations from unauthorized data exfiltration at the network edge.\n\nKey Findings\n\n- CVE-2026-26980: A blind SQL injection vulnerability in the Ghost CMS Content API (versions 3.24.0 to 6.19.0) allows unauthenticated remote attackers to inject malicious SQL commands via query parameters due to improper input validation.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...b4c29bc6 | N/A | Ghost CMS - SQLi - CVE:CVE-2026-26980 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...b56f403f | N/A | SQLi - Obfuscated Boolean - URI | Log | Disabled | This is a new detection. |","published_at":"2026-06-15T18:55:56+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}