CVE-2026-29784 Ghost: Incomplete CSRF protections around OTC use

High 7.5 Published 7 Mar 2026 Updated 9 Mar 2026

Incomplete CSRF protections in Ghost CMS allow attackers to hijack sessions via OTCs, potentially leading to site takeover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-29784?

CVE-2026-29784 is a high-severity vulnerability in TryGhost Ghost, published on 7 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.

Weakness: CWE-352

Which versions are affected by CVE-2026-29784?

3 open source packages ship an affected version, including ghost. It affects 1 product.

Package	Affected	Fixed in
`ghost` Bitnami	From `5.101.6`	`6.19.3`
`ghost` npm	From `5.101.6`	`6.19.3`
`ghost` npm	From `5.101.6`	`6.19.3`

Products include Ghost Ghost.

How do I fix CVE-2026-29784?

Upgrade ghost to 6.19.3 or later.

Is CVE-2026-29784 being exploited?

There is no known exploitation of CVE-2026-29784 in the wild and no public exploit code.

Sources

Also known as BIT-ghost-2026-29784, GHSA-9m84-wc28-w895.