CVE-2026-53945

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/TryGhost/Ghost/security/advisories/GHSA-ch52-px8q-f22j

Configurations

No configuration.

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Ghost es un sistema de gestión de contenido Node.js. Desde la versión 6.0.9 hasta la 6.21.1, la verificación de IP privada de Ghost para solicitudes HTTP salientes podría ser eludida mediante la reconfiguración de DNS (DNS rebinding), permitiendo a un atacante obligar al servidor Ghost a alcanzar hosts en redes internas a través de funciones que realizan recuperaciones externas. Esta vulnerabilidad está corregida en la versión 6.21.1.

Information

Published : 2026-06-24 19:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-53945

Mitre link : CVE-2026-53945

CVE.ORG link : CVE-2026-53945

JSON object : View

Products Affected

No product.

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-53945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T15:38:04.884131Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "TryGhost", "product": "Ghost", "versions": [{"status": "affected", "version": ">= 6.0.9, < 6.21.1"}]}]}], "published": "2026-06-24T19:17:12.090", "references": [{"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-ch52-px8q-f22j", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost\u2019s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1."}, {"lang": "es", "value": "Ghost es un sistema de gesti\u00f3n de contenido Node.js. Desde la versi\u00f3n 6.0.9 hasta la 6.21.1, la verificaci\u00f3n de IP privada de Ghost para solicitudes HTTP salientes podr\u00eda ser eludida mediante la reconfiguraci\u00f3n de DNS (DNS rebinding), permitiendo a un atacante obligar al servidor Ghost a alcanzar hosts en redes internas a trav\u00e9s de funciones que realizan recuperaciones externas. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 6.21.1."}], "lastModified": "2026-10-25T22:10:00.150", "sourceIdentifier": "security-advisories@github.com"}