Ghost CVE-2026-53943: update target corrected from 6.37.0 to v6.54.1

Ghost, a popular platform for building blogs and sending newsletters, has been found to contain a vulnerability (a software flaw) that lets an attacker poison the site's display from outside and potentially take over the operator's account. It is tracked as CVE-2026-53943, with a severity of 9.6 out of 10 (Critical).

The affected versions are 4.0.0 through 6.36.0. The GitHub security advisory went out on May 28, 2026, and the entry reached NVD on June 24. The fix is included in 6.37.0. When an attacker sends a specific header (information attached to a request) without authentication, a poisoned display can be served to other visitors too, and especially when the public site and the admin panel run on the same domain, it can lead to takeover of an editor's or staff member's account.

As of late July, though, 6.37.0 is not the version to land on. What follows covers the two fixes that arrived after it, and the separate Ghost flaw that has already been used to compromise more than 700 sites.

What kind of service is Ghost?

Ghost is an open-source publishing/blogging tool (CMS) that handles creating and publishing articles, managing members, paid subscriptions, and sending email newsletters all in one. Like WordPress, you can run it on your own server, and it is favored by professional writers and news outlets. According to its official site, publications running on Ghost generate over $100 million in combined annual revenue, with users including 404 Media, Platformer, and Y Combinator.

On high-traffic sites, it is common to put a cache (a mechanism that temporarily stores and reuses a once-built display) in front to speed things up. This flaw is the kind known as "cache poisoning," whose danger jumps when combined with such a cache.

Who targets it, what they do, and what happens

The targets are operators running a site on Ghost with a shared cache in front for speed, and with the public site and admin panel on the same domain. This is not a special configuration; it arises from a combination of common setups. The attack requires no login on the operator's side and can be carried out by an outside third party.

What an attacker does is send a request with a specific "x-ghost-preview" header, make the site build a display with different contents than normal, and get the shared cache to memorize it. Once the cache is poisoned, the poisoned display is served as-is to other visitors who access the site afterward.

The most dangerous case is when the public site and the admin panel share the same domain. Through the poisoned response, an editor's or staff member's account that can edit the site may be taken over. Once that happens, it leads to damage that shakes the whole site's trust: tampered articles, planted misinformation, access to member data, and the addition of rogue accounts. For readers, a site they trust could be rewritten without their knowledge.

It is reported that running the public site and the admin panel on separate domains eliminates this takeover risk. For CVE-2026-53943 itself, no in-the-wild exploitation and no public exploit code have surfaced as of July 29. It is also absent from the U.S. agency CISA's "list of vulnerabilities under active attack" — in fact, that catalog contains no Ghost entries at all. We maintain a Japanese-language overview of the list in our CISA KEV Dashboard (Japanese edition).

What the vulnerability is

A cache works on the premise that "the same URL returns the same contents." The problem here is that this premise can be broken with a header attached from outside.

CVE-2026-53943: a preview header poisons the cache, leading to takeover (CVSS 9.6)

According to the published information, the "x-ghost-preview" header sent without authentication caused Ghost to change the response of the public site. With a shared cache in front of Ghost, this altered response is stored in the cache and served to other visitors too. In environments where the public site and admin panel share the same domain, this poisoning is described as potentially leading to staff account takeover.

In the fixed version 6.37.0, the handling of this header was reworked. A CMS also pulls in many externally sourced themes and plugins, so inspecting all the components that make up your site is worth revisiting alongside the ideas in our OSS supply-chain scanner overview.

Two fixes that landed after 6.37.0

Since the first version of this article went out, two security fixes have shipped that 6.37.0 does not contain. Both are separate from CVE-2026-53943, and an installation sitting at 6.37.0 is missing both.

CVE-2026-59817: paid gift memberships obtained for a trivial amount via donations (CVSS 5.3)

Published on June 23, 2026 as GHSA-xm43-3m56-w3wf, this flaw lets someone route through Ghost's donations feature to obtain a gift membership — normally a paid tier — for an extremely small amount. The severity is a middling CVSS 5.3 (Medium), but no authentication is required and no action by a site user is needed. For publications earning revenue from paid subscriptions, the problem is less the money involved than the fact that the payment premise breaks.

The affected range is 6.27.0 through 6.43.1, with the fix in v6.44.0 (released June 3, 2026). In other words, an installation that moved to 6.37.0–6.43.1 to address CVE-2026-53943 lands squarely inside this flaw's range. If you cannot update right away, the advisory describes a stopgap: temporarily disable the donations feature from the admin panel.

v6.50.0: a stored XSS fix with no number attached

The second one is harder to spot. The release notes for v6.50.0 (released July 2, 2026) carry a single line: "Fixed stored XSS and mangled structured data in JSON-LD output (#29013)." The structured data Ghost emits for search engines (JSON-LD) carried a stored XSS — a flaw where malicious script saved into the site runs in visitors' browsers — and that release fixed it.

The catch is that the fix has no CVE number and no GHSA number. An operation that watches only vulnerability databases and scanners will never see it. The absence of an advisory does not mean nothing security-relevant shipped. For software that releases as often as a CMS does, adding a habit of reading the "Fixed" lines in release notes — not just tracking vulnerability identifiers — cuts down on these blind spots.

A quick check of whether you are affected

CVE-2026-53943 affects 4.0.0 through 6.36.0 and is fixed in 6.37.0. The combination of "a shared cache" and "the public site and admin panel on the same domain" is the most dangerous. As of July 29, 2026, however, the only version that needs no action is v6.54.1 or later. You can check in the version shown in the admin panel.

Splitting the public site and admin panel across separate domains lowers the takeover risk, but the problem of a poisoned display being served to other visitors remains. And stopping at 6.37.0 leaves other flaws open, so updating to v6.54.1 or later is recommended in any case.

What to do now

The top priority is to update Ghost to v6.54.1 or later. If you use Ghost(Pro) hosting, the provider updates it for you, but if you run it on your own server, raise the version urgently. That includes installations already sitting at 6.37.0.

If you cannot update immediately, these mitigations help: at the cache in front (CDN or reverse proxy), strip the "x-ghost-preview" header, or configure pages whose response varies on this header not to be cached. Where possible, split the public site and admin panel onto separate domains. If you are on 6.37.0–6.43.1 and cannot update, temporarily disable the donations feature from the admin panel. Also inspect for any added admin or staff accounts you do not recognize and any suspicious article changes.

Recovery steps if you suspect a compromise

If there are signs you were already breached, updating alone is not enough: staff sessions and credentials an attacker captured keep working after the update. The advisory for CVE-2026-53943 states that if compromise is suspected, you should use the account authentication reset that Ghost provides from v6.41.0 onward. Updating to v6.54.1 gets you that feature, so run the reset once the update is done.

Running it invalidates existing login sessions and credentials, and every staff member has to sign in again. It takes effort, but it is the way to definitively cut off access that may have been stolen through a poisoned response. Reissue your API keys and review the list of accounts holding administrator rights at the same time.

A different Ghost flaw, CVE-2026-26980, is being exploited across 700+ sites

What follows concerns a vulnerability separate from CVE-2026-53943, the subject of this article — drawing that line first, so the two do not get conflated. 53943 is cache poisoning via a preview header, with no reports of real-world exploitation so far. CVE-2026-26980, described below, has a completely different entry point and affected range, and is already being exploited at scale in the wild.

CVE-2026-26980 is a blind SQL injection (slipping database commands in from outside) against Ghost's Content API. Its severity is CVSS 9.4 (Critical), it was patched in February 2026, and the fixed release is 6.19.1. Updating to v6.54.1 naturally closes it as well.

According to observations by the Chinese security firm Qianxin, more than 700 sites have been compromised through this flaw, including blogs run by DuckDuckGo, Harvard University, and the University of Oxford. The attack chain steals the Admin API key without authentication, then uses that key to mass-inject malicious JavaScript into existing posts through the Ghost Admin API. The injected script funnels readers into "ClickFix"-style attacks, where the victim is walked through fake instructions and installs malware themselves. At the time of reporting, at least two groups were still actively poisoning sites.

For a publication whose readers trust what they read, having attack code planted in the article body itself is the worst shape this can take. If you run a Ghost install at 6.19.0 or earlier, deal with this before CVE-2026-53943. Because compromise is plausible already, go beyond updating: check posts for scripts you did not put there, reissue API keys, and run the account authentication reset described above. The reporting from SecurityWeek and The Hacker News covers the details.

Some secondary write-ups state that CVE-2026-26980 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Checking the catalog directly shows it is not. As of July 29, KEV holds no Ghost CMS entries at all. Widely confirmed exploitation and inclusion in KEV are two different things.

Summary

Ghost's CVE-2026-53943 is a vulnerability in which a preview header that can be sent without authentication poisons the display and serves it to other visitors via a shared cache. When the public site and admin panel share the same domain, it can lead to staff account takeover. Its rating is unchanged: CVSS 9.6, affecting 4.0.0 through 6.36.0, fixed in 6.37.0.

What changed is the version to update to. After 6.37.0 came CVE-2026-59817 in the donations feature (fixed in 6.44.0) and the unnumbered stored-XSS fix in v6.50.0. As of July 29, 2026, the target is v6.54.1 or later. On top of that, the separate flaw CVE-2026-26980 is being exploited across more than 700 sites, so anything at 6.19.0 or earlier needs emergency attention. Where compromise is suspected, follow the update with the v6.41.0-and-later account authentication reset. If new vulnerabilities concerning Ghost emerge, we will track them by adding to this article.

References

• ▸NVD - CVE-2026-53943 (Ghost cache poisoning, staff takeover)
• ▸GitHub Security Advisory - GHSA-62q6-4hv4-vjrw (includes recovery steps)
• ▸GitHub Security Advisory - GHSA-xm43-3m56-w3wf (CVE-2026-59817, donations)
• ▸Ghost v6.50.0 release notes (unnumbered stored-XSS fix)
• ▸Ghost v6.54.1 release notes (current latest)
• ▸NVD - CVE-2026-26980 (Content API SQL injection, CVSS 9.4)
• ▸SecurityWeek - Ghost CMS vulnerability exploited to hack over 700 websites
• ▸The Hacker News - CVE-2026-26980 exploitation and ClickFix attacks
• ▸Ghost official site (use cases, publications)
• ▸Ghost official docs (operations, configuration)