CVE-2026-105682 Ghost: Server-Side Request Forgery in Webhook Trigger
Staff users can exploit a webhook feature to probe internal network hosts, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-105682?
CVE-2026-105682 is a low-severity server-side request forgery vulnerability in TryGhost Ghost, published on 5 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-105682?
How do I fix CVE-2026-105682?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-105682 being exploited?
There is no known exploitation of CVE-2026-105682 in the wild and no public exploit code.