CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API
Staff users can leak hashed passwords of other staff via the Admin API, potentially enabling offline cracking and account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-70590?
CVE-2026-70590 is a medium-severity vulnerability in TryGhost Ghost, published on 4 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.
Weakness: CWE-200
Which versions are affected by CVE-2026-70590?
3 open source packages ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | All versions | 6.54.1 |
ghost npm | All versions | 6.54.1 |
ghost npm | All versions | 6.54.1 |
How do I fix CVE-2026-70590?
Upgrade ghost to 6.54.1 or later.
Is CVE-2026-70590 being exploited?
There is no known exploitation of CVE-2026-70590 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-70590, GHSA-jm22-3w23-5q7w.