A popular blogging platform has a serious problem, attackers can steal admin passwords and API keys without ever logging in, and the vulnerability has existed for years.
The Ghost CMS unauthenticated SQL injection vulnerability tracked as CVE-2026-26980 affects Ghost versions from 3.24.0 through 6.19.0, and security researcher Maksim Rogov discovered the flaw along with releasing a full Python exploit tool.
The Ghost CMS unauthenticated SQL injection vulnerability resides in the Content API's filter parameter, and attackers can inject malicious SQL code without any authentication whatsoever.
What Is Ghost CMS?
Ghost, an open-source blogging and publication platform, provides an alternative to WordPress with a focus on professional-grade published content and an equally professional-looking user interface. Content creators and news organizations commonly utilize Ghost to create their website content.
The Ghost CMS includes a vulnerability in its unauthenticated SQL Injection function that can be exploited by attackers who have access to both self-hosted instances of the platform and those hosted by Ghost Pro. The vulnerability in question exists when the Ghost CMS interfaces with requested tag filters.
Technical Root Cause
The cause of the Ghost CMS' inability to protect against unauthenticated SQL Injection through the Content API tag-slug filtering method is that the database request does not correctly filter user input prior to sending it to the database. A typical Content API request looks like this: ghost/api/content/tags/?key=API_KEY&filter=slug:['slug-value']
If someone submitted a request using the filtering method of tag slug, then Ghost CMS would allow for SQL Code Injection, which is injected into the request, and subsequently is unable to properly sanitize user input any further prior to being sent to the database.
The Ghost CMS vulnerability allows attackers to perform a Boolean Blind SQL Injection attack. Attackers using this method will make true/false requests against the database by making queries on the Content API and then determining what the answer is by seeing whether an InternalServerError or badrequesterror message was returned.
Affected Versions
The Ghost CMS unauthenticated SQL injection vulnerability affects a wide range of Ghost versions:
1. Ghost 3.24.0 through 6.19.0 are vulnerable
2. Ghost 6.16.1 has been confirmed vulnerable during testing
3. Earlier versions below 3.24.0 may also be affected
If you are running Ghost version 6.19.0 or any older version, the Ghost CMS unauthenticated SQL injection vulnerability is present on your site.
Supported Database Engines
The Ghost CMS unauthenticated SQL injection exploit works on both SQLite and MySQL databases, which covers nearly all Ghost installations.
For SQLite databases (common in local and small blog deployments), the Ghost CMS unauthenticated SQL injection exploit uses the GLOB operator for character extraction, and it triggers integer overflow errors to generate detectable error messages.
The Ghost CMS unauthenticated SQL Injection Exploit uses the functions ASCII() and SUBSTR() along with the exp(710) method that will cause double overflow errors on MySQL databases (common on production Ghost sites) to retrieve data.
Steps of the Exploit
There are three distinct phases involved with the Ghost CMS unauthenticated SQL Injection Exploit:
1. Discovery Phase - The Exploit makes a request to the target homepage and retrieves the key used to access the Content API as well as the path to the Content API endpoint. The next step is to find the slug and id of the first tag so it can build out the url template of the vulnerable URL.
2. Oracle Calibration - The Exploit uses a test query to check whether the injection point is working or not. Specifically, the Exploit sends a query asking whether 1=1 returns an error (which it shouldn't) and 1=2 does not return an error (which it should).
3. Data Extraction - The Exploit uses boolean blind SQL injection to extract each individual character (from the target value) by determining the length of the target value using a binary search and then extracting the character at each successive position according to a pre-defined character set.
In addition, the Ghost CMS unauthenticated SQL Injection Exploit supports threading and can be used concurrently with up to 15 workers (default). This provides a significant performance improvement over single-threaded methods for data extraction.
What Data Can Be Stolen
Possible Ways To Gain Access To Data Via Ghost Destructive CMS Unauthenticated SQL Injection Exploit
Using an anonymous account on Ghost CMS, an attacker can perform the following types of actions:
1. Accessing User Accounts. The anonymous attacker is able to utilize the SQL injection exploit to look up the email addresses (e.g., user id; admin name; password hashes) of each user from the user account table using the password hashing algorithm ( bcrypt ).
The attacker can breach the administrator’s account by cracking the hashed password offline to obtain the plain-text form of the user’s password.
2. Accessing API Keys. An attacker can extract the API key and API secret from the api_keys table, which will provide the attacker with full control of an installed instance of Ghost CMS via these methods (API Key).
3. Accessing Membership Records. If the installation is utilizing the membership features of Ghost, then the attacker can also look up user membership records (e.g., email address; name; current membership status) by accessing the members table.
4. Accessing Session Tokens. In addition the attacker could also look up the session tokens currently being used by accessing the sessions table.
Exploiting Tool
Maksim Rogov has developed a complete Python Exploiting Tool that is used to exploit an Unauthenticated SQL Injection vulnerability in the Ghost CMS.
This Exploitation Tool has multiple powerful features:
1. Auto-discovery of inserting the API key and endpoint in a matter of seconds. This way Users do not have to locate this information manually.
2. This tool has an enormous advantage using Multi-threading, allowing Users to increase their speed of initial information extraction. With the tool, Users can input the number of Threads to use on the command line.
3. Selective dumping of specific tables such as Users, api_keys, and Members or Posts by using the -C parameter to specify columns you want to extract.
4. This tool allows Users to export their extracted data to a CSV file for easier post-processing and analysing of the data.
5. The exploitation tool will also automatically detect whether the database being targetted SQLite or MySQL and correspondingly inject the appropriate payload for that respective database.
Sample Exploit Scenarios
Here is a Sample of what a typical Unauthenticated SQL Injection exploit against a Ghost CMS might look like:
Release info gathering - python3 exploit.py -u http://target-ghost.com
This command exploits the Unauthenticated SQL Injection against a Ghost CMS. It will retrieve the Admin Users Email Address, Admin Users Name, and Password Hash from the Default Installation of SQLite as well as collect the Admin API Key ID and Secret from that installation.
Table dumping: python3 exploit.py -u http://target-ghost.com -d mysql -T users -C email,password -o results.csv
This command dumps the email and password columns from the users table on a MySQL-based Ghost site, and it saves the results to a CSV file.
API key theft: python3 exploit.py -u http://target-ghost.com -d mysql -T api_keys -t 25
This command dumps all API keys from the api_keys table using 25 threads for faster extraction.
Why This Vulnerability Is Critical
The Ghost CMS Unauthenticated SQL Injection Vulnerability has been of interest for a variety of reasons:
1. No authentication is necessary for the attacker; a username, password, or API key is not necessary for an attacker to exploit this vulnerability, and the Content API endpoint of Ghost CMS is public by design.
2. A Remote Attack - The Ghost CMS Unauthenticated SQL Injection Vulnerability is capable of being exploited remotely. All an attacker requires to exploit this vulnerability is the URL of the targeted Ghost site, the Ghost Outputted Content, and either an Internet-enabled device (typically) or an accessible Internet connection.
3. An attacker can extract from the database the passwords and the API keys of all stored user accounts, as well as some or all of the data stored within the relevant database.
4. There are a large range of Ghost CMS versions that are affected (3.24.0-6.19.0), so even if your site has not been updated for a long time, it still may be affected by this vulnerability.
Ghost CMS Response
Patching for an Unauthenticated SQL Injection Vulnerability in Ghost CMS have been made available to all users through an immediate upgrade of your Ghost CMS installation to version 6.20.0 or higher.
The Unauthenticated SQL Injection vulnerability within Ghost CMS has been patched at the code level; as well as by sanitizing any filtered input before passing through to the database engine.
If you are running Ghost Pro (Ghost's hosted service), the platform has likely been patched automatically, but self-hosted users must apply the update manually.
How to Protect Your Ghost Site
The Ghost CMS unauthenticated SQL injection vulnerability is serious, but you can protect your site.
1. Update Ghost immediately. The Ghost CMS unauthenticated SQL injection vulnerability is fixed in version 6.20.0 and later, run ghost update from your Ghost installation directory.
2. Check your current version. Run ghost version to see which Ghost version you are running, if your version is below 6.20.0 you are vulnerable.
3. Refresh all API keys. The Ghost CMS unauthenticated SQL injection vulnerability was likely exploited prior to fixing it, therefore all Content API keys and Admin API keys should be created anew from the Ghost admin panel.
4. Reset all admin passwords. It is possible that an attacker has retrieved admin password hashes so you will want to make sure to force all users to change their passwords after they are patched.
5. Monitor access logs. Check your Ghost access logs for unusual filter=slug: parameters containing SQL keywords like SELECT, OR, AND, GLOB, or ASCII, the Ghost CMS unauthenticated SQL injection exploit leaves these traces.
Final Thoughts
The Ghost CMS unauthenticated SQL injection vulnerability (CVE-2026-26980) is a reminder that API endpoints need the same security scrutiny as login forms, the Content API was designed to be public and accessible, but that accessibility became the attack surface.
The Ghost CMS unauthenticated SQL injection exploit is trivial to use, the Python tool works out of the box, and any script kiddie with basic command line skills can dump your database.
If you run Ghost, stop reading and check your version right now, update if needed, rotate your keys, and change your passwords, because the internet is full of scanners looking for vulnerable Ghost sites.
FAQ Section
Q1: What versions of Ghost are affected by CVE-2026-26980?
The Ghost CMS unauthenticated SQL injection vulnerability affects Ghost versions 3.24.0 through 6.19.0, Ghost 6.16.1 has been confirmed vulnerable, and versions below 3.24.0 may also be affected.
Q2: Does the Ghost CMS unauthenticated SQL injection require authentication?
No, the Ghost CMS unauthenticated SQL injection vulnerability requires no authentication at all, the Content API endpoint is intentionally public, and attackers only need the target site's URL to exploit it.
Q3: What databases are affected by this SQL injection?
The Ghost CMS unauthenticated SQL injection vulnerability works on both SQLite (common in local and small blogs) and MySQL (common in production Ghost sites), and the exploit automatically adjusts its payloads based on the database type.
Q4: Can the exploit steal password hashes?
Yes, the Ghost CMS unauthenticated SQL injection exploit can extract password hashes from the users table, these are bcrypt hashes which are resistant to cracking but still vulnerable to offline brute force attacks over time.
Q5: How do I know if my Ghost site has been exploited?
Check your web server access logs for requests to the Content API endpoint containing unusual filter=slug: parameters with SQL keywords like SELECT, OR, AND, GLOB, ASCII, or EXP, the Ghost CMS unauthenticated SQL injection exploit leaves these patterns in the logs.
