CVE-2026-103287: Ghost CMS SSRF Vulnerability in Webhooks

CVE-2026-103287 Overview

CVE-2026-103287 is a Server-Side Request Forgery (SSRF) vulnerability in Ghost, the open-source publishing platform. The flaw affects Ghost versions 1.18.0 through versions prior to 6.27.0 and resides in the webhooks feature. Authenticated staff users can craft webhook requests that cause the Ghost server to issue outbound HTTP requests to internal network resources. This allows attackers with staff-level credentials to probe internal hosts that would otherwise be unreachable from the public internet. The weakness is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated staff users can abuse the webhooks feature to send server-originated requests against internal infrastructure, enabling reconnaissance of private network services.

Affected Products

Ghost versions 1.18.0 and later
Ghost versions prior to 6.27.0
Self-hosted Ghost deployments exposing the Admin API with webhooks enabled

Discovery Timeline

2026-10-01 - CVE-2026-103287 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103287

Vulnerability Analysis

Ghost allows staff users to configure webhooks that fire HTTP callbacks when specific events occur in the platform. The webhook delivery subsystem accepts a user-supplied target URL and performs an outbound HTTP request from the Ghost server process. The vulnerable code paths do not restrict the destination to public, routable addresses, and they do not block requests directed at loopback addresses, link-local ranges, or RFC1918 private networks. An authenticated staff user can therefore register a webhook pointing at http://127.0.0.1, http://169.254.169.254, or an internal service on 10.0.0.0/8 and observe the server's behavior. Response status codes, timing differences, and error messages reveal which internal hosts and ports are reachable from the Ghost server.

Root Cause

The root cause is missing destination validation in the webhook request handler. Ghost treats the webhook target URL as trusted input once the staff role check succeeds. The platform does not resolve the target hostname and compare it against a denylist of internal address ranges before dispatching the request. This design places full trust in the staff role boundary, which is insufficient when staff accounts are shared, delegated, or compromised.

Attack Vector

Exploitation requires an authenticated account with staff privileges and network access to the Ghost Admin API. The attacker creates or updates a webhook through the API with a URL that targets an internal resource. When the subscribed event fires, Ghost issues the request from its own network position. In cloud deployments, this often grants reachability to metadata endpoints such as the AWS Instance Metadata Service, internal databases, and management interfaces that are isolated from the public internet. The vulnerability does not affect confidentiality of Ghost application data directly, but it exposes adjacent infrastructure to probing.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-354h-gmhv-mr9c and the VulnCheck Ghost SSRF Advisory for technical details.

Detection Methods for CVE-2026-103287

Indicators of Compromise

Webhook configurations in Ghost with target URLs pointing to loopback, link-local, or RFC1918 address ranges
Outbound HTTP requests from the Ghost server process to internal IP ranges or cloud metadata endpoints such as 169.254.169.254
Unexpected creation or modification of webhook entries by staff accounts, especially outside normal administrative hours

Detection Strategies

Audit the Ghost webhooks table or Admin API endpoint /ghost/api/admin/webhooks/ for target URLs that resolve to private address space
Inspect reverse proxy and egress firewall logs for requests originating from the Ghost host directed at internal services
Correlate staff user activity with webhook create and update events to identify abuse of elevated accounts

Monitoring Recommendations

Enable egress filtering on the host running Ghost and alert on any attempted connection to private or metadata address ranges
Forward Ghost application logs and webhook delivery logs to a centralized logging platform for correlation with network telemetry
Monitor Admin API authentication events for staff accounts and flag unusual geographic or client fingerprint changes

How to Mitigate CVE-2026-103287

Immediate Actions Required

Upgrade Ghost to version 6.27.0 or later, which addresses the SSRF in the webhook handler
Review all existing webhook configurations and remove any entries targeting internal, loopback, or metadata addresses
Rotate credentials for staff accounts and audit staff role assignments to confirm least privilege

Patch Information

The maintainers resolved the issue in Ghost 6.27.0. Operators of self-hosted Ghost should upgrade using the standard ghost update workflow or redeploy container images referencing a fixed tag. Managed Ghost(Pro) tenants receive the patch through the hosted service. See the GitHub Security Advisory GHSA-354h-gmhv-mr9c for upgrade details.

Workarounds

Restrict outbound network access from the Ghost server to the specific external endpoints required for legitimate webhook destinations
Place Ghost behind an egress proxy that enforces a denylist for RFC1918, loopback, and cloud metadata address ranges
Limit staff role assignments and require multi-factor authentication for all Ghost Admin accounts until the upgrade is complete

bash

# Example iptables egress rules to block common internal targets from the Ghost host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT