CVE-2026-103291: Ghost CMS SSRF Vulnerability

CVE-2026-103291 Overview

CVE-2026-103291 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Ghost versions from 3.20.2 before 6.51.0. The flaw resides in the image dimension refetching logic, where authenticated staff users can trigger outbound HTTP requests to arbitrary URLs. Attackers abuse image cards by pointing them at attacker-controlled hosts or internal network endpoints. This grants access to cloud metadata services and internal resources that are not reachable from the public internet.

Critical Impact
Authenticated staff users can coerce the Ghost server into issuing outbound HTTP requests to internal services, enabling access to cloud instance metadata and other restricted endpoints.

Affected Products

Ghost versions 3.20.2 through versions prior to 6.51.0
Self-hosted Ghost deployments exposing the admin interface to staff users
Ghost instances running in cloud environments with reachable metadata services (AWS, GCP, Azure)

Discovery Timeline

2026-10-01 - CVE-2026-103291 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103291

Vulnerability Analysis

Ghost's editor supports image cards that reference external URLs. When the platform refetches image dimensions, the backend performs an outbound HTTP request against the URL supplied in the card metadata. The request path does not restrict destinations to public, routable addresses, nor does it validate the resolved host against an allowlist.

An authenticated staff user can supply a URL that targets internal hostnames, loopback interfaces, or cloud metadata endpoints such as http://169.254.169.254/. The Ghost server performs the fetch from its own network position. This exposes services that would otherwise be unreachable from external callers.

The impact depends on the hosting environment. In cloud deployments, attackers can retrieve instance identity documents, session tokens, or configuration data from metadata services. In corporate networks, attackers can enumerate internal HTTP services and probe reachable administrative interfaces.

Root Cause

The root cause is missing destination validation in the image size fetch handler. Ghost accepts any URL submitted through image card payloads and dispatches an outbound request without checking the resolved IP against private, link-local, or reserved address ranges. The fix in version 6.51.0 restricts outbound requests to vetted destinations.

Attack Vector

Exploitation requires an authenticated session with staff-level privileges. The attacker edits or creates content that embeds an image card referencing a target URL. When Ghost refetches image dimensions, it sends the SSRF payload. See the GitHub Security Advisory GHSA-rrq6-9r3c-7w26 and the VulnCheck SSRF Advisory for Ghost for additional technical context.

Detection Methods for CVE-2026-103291

Indicators of Compromise

Outbound HTTP requests from the Ghost application host to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16).
Access attempts from the Ghost server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Image card entries in post content referencing non-image URLs or internal hostnames.

Detection Strategies

Monitor Ghost application logs for image size fetch operations against hosts not matching known content delivery networks.
Inspect egress proxy logs for Ghost-originated requests with unusual Host headers or private-range destinations.
Correlate staff user activity in the Ghost admin API with outbound network connections from the application tier.

Monitoring Recommendations

Enable DNS query logging on Ghost hosts and alert on resolution of internal or reserved zones.
Instrument the hosting environment to flag any process-level connections from the Ghost worker to metadata service IPs.
Review audit logs for staff account creation or privilege changes that precede unexpected outbound traffic.

How to Mitigate CVE-2026-103291

Immediate Actions Required

Upgrade Ghost to version 6.51.0 or later, which restricts outbound image dimension fetches to permitted destinations.
Audit staff user accounts and remove inactive or unnecessary accounts to reduce the authenticated attack surface.
Enforce IMDSv2 or equivalent session-based metadata access on cloud instances hosting Ghost to blunt metadata exfiltration.

Patch Information

The vulnerability is fixed in Ghost version 6.51.0. Operators running any version from 3.20.2 up to but not including 6.51.0 should upgrade. Refer to the GitHub Security Advisory GHSA-rrq6-9r3c-7w26 for the official vendor advisory and release notes.

Workarounds

Place Ghost behind an egress proxy that denies connections to private, loopback, and link-local address ranges until patching is complete.
Apply network policies or security groups that prevent the Ghost application tier from reaching cloud metadata endpoints and internal management interfaces.
Restrict staff user provisioning and require multi-factor authentication to limit who can submit image card payloads.

bash

# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT