---
id: "CVE-2026-26980"
kind: "vulnerability"
aliases: ["CVE-2026-26980"]
title: "Ghost CMS: unauthenticated blind SQL injection in Content API"
severity: "critical"
cvss: 9.4
epss: 0.05573
exploited: false
status: "open"
category: "vendor"
products: [{"name": "ghost", "fixed": ["6.19.1"], "affected": ">= 3.24.0, < 6.19.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloudflare", "cms", "ghost", "lab-disclosure", "node.js", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "version-outside-range"]
published_at: "2026-02-20T02:16:54+00:00"
first_seen_at: "2026-10-24T18:56:54+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-06-15-waf-release/", "first_seen_at": "2026-10-24T18:56:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26980", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26980", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Ghost CMS: unauthenticated blind SQL injection in Content API

Ghost, a Node.js content management system, has a blind SQL injection flaw in its Content API query parameters, affecting versions 3.24.0 through 6.19.0. An unauthenticated remote attacker can inject SQL commands to exfiltrate data from the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ghost affected >= 3.24.0, < 6.19.1 fixed 6.19.1

## How to check

- Check the installed Ghost version (for example with `ghost version` or the `ghost` entry in `package.json`) and see whether it falls in `3.24.0` to `6.19.0`
- Confirm whether the Content API is exposed to the internet on the site
- unknown for any other check the sources do not describe

## Fix

- Upgrade Ghost to `6.19.1` or later
- If upgrading is not possible right away, the Cloudflare WAF managed rule 'Ghost CMS - SQLi - CVE:CVE-2026-26980' blocks the attack at the network edge
- unknown for other mitigations the sources do not describe

## Timeline

- 2026-10-24T18:56:54+00:00 lab https://developers.cloudflare.com/changelog/post/2026-06-15-waf-release/ — Cloudflare: WAF Release - 2026-06-15 · Changelog
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-26980
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-26980

## Documents

- [advisory] Cloudflare: WAF Release - 2026-06-15 · Changelog https://developers.cloudflare.com/changelog/post/2026-06-15-waf-release/

## From the sources

WAF Release - 2026-06-15 · Changelog

# Changelog

New updates and improvements at Cloudflare.

June 15, 2026

## WAF Release - 2026-06-15

This week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic. These rules protect affected installations from unauthorized data exfiltration at the network edge.

Key Findings

- CVE-2026-26980: A blind SQL injection vulnerability in the Ghost CMS Content API (versions 3.24.0 to 6.19.0) allows unauthenticated remote attackers to inject malicious SQL commands via query parameters due to improper input validation.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...b4c29bc6 | N/A | Ghost CMS - SQLi - CVE:CVE-2026-26980 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...b56f403f | N/A | SQLi - Obfuscated Boolean - URI | Log | Disabled | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_