# CVE-2026-26980: Ghost - SQLi

> Live exploitation tracking for CVE-2026-26980 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-26980

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** TryGhost Ghost
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** nodejs, cms

## Description

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

## CrowdSec analysis

[CVE-2026-26980](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-26980) is a high-severity vulnerability in Ghost, a popular Node.js content management system, affecting versions 3.24.0 through 6.19.0. This flaw allows unauthenticated attackers to perform arbitrary database reads, potentially exposing sensitive information and paving the way for further exploitation. Attackers could leverage this SQL injection vulnerability to access confidential data or escalate their attacks against affected Ghost installations.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-26980 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/ghost/api/content/tags/` endpoint by injecting SQL payloads into the `filter` parameter, allowing them to extract sensitive data from the Ghost CMS database. This attack is typically performed using unauthenticated requests with crafted `filter` values to trigger blind SQL injection.

## Timeline

- 2026-02-20: CVE Published. CVE-2026-26980 is published to NVD.
- 2026-05-22: Rule Released. CrowdSec releases a rule to detect CVE-2026-26980 exploitation attempts against the CrowdSec Network.
- 2026-05-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-26980 for the first time.

## References

- https://github.com/TryGhost/Ghost/releases/tag/v6.19.1
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97
- https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26980.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-26980) follows observed exploitation activity for CVE-2026-26980. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.