CVE-2026-26980

Date: February 19, 2026

Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Workarounds There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability. As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing "slug%3A%5B" or "slug:[" in the query string filter parameter. Note that this may break legitimate slug filter functionality. References We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at "security@ghost.org" (mailto:security@ghost.org).