CVE-2026-22594 Ghost has Staff 2FA bypass
Attackers can bypass email two-factor authentication for staff users in Ghost CMS, potentially leading to unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22594?
CVE-2026-22594 is a high-severity authentication bypass vulnerability in TryGhost Ghost, published on 10 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-22594?
5 open source packages ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.105.0 | 5.130.6, 6.11.0 |
ghost npm | From 5.105.0 | 5.130.6 |
ghost npm | From 5.105.0 | 5.130.6 |
ghost npm | From 6.0.0 | 6.11.0 |
ghost npm | From 6.0.0 | 6.11.0 |
Products include Ghost Ghost.
How do I fix CVE-2026-22594?
Upgrade ghost to a fixed version for your release line: 5.130.6 or 6.11.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-22594 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22594 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in TryGhost Ghost
Sources
Also known as BIT-ghost-2026-22594, GHSA-5fp7-g646-ccf4.