Ghost - SQLi (CVE-2026-26980)

CVE-2026-26980 is a high-severity vulnerability in Ghost, a popular Node.js content management system, affecting versions 3.24.0 through 6.19.0. This flaw allows unauthenticated attackers to perform arbitrary database reads, potentially exposing sensitive information and paving the way for further exploitation. Attackers could leverage this SQL injection vulnerability to access confidential data or escalate their attacks against affected Ghost installations.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-26980 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the /ghost/api/content/tags/ endpoint by injecting SQL payloads into the filter parameter, allowing them to extract sensitive data from the Ghost CMS database. This attack is typically performed using unauthenticated requests with crafted filter values to trigger blind SQL injection.