CVE-2026-105647: Ghost CMS SSRF Vulnerability

CVE-2026-105647 Overview

CVE-2026-105647 is a Server-Side Request Forgery (SSRF) vulnerability in Ghost, a Node.js content management system. The flaw affects versions 6.54.1 through 6.65.0 and stems from insufficient validation in functionality such as Webmentions. An unauthenticated attacker can abuse the issue to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack does not return response data to the attacker, which constrains data exfiltration but still enables internal network probing. The issue is categorized under CWE-367 and is fixed in Ghost version 6.65.0.

Critical Impact
Unauthenticated attackers can induce the Ghost server to issue outbound HTTP requests to internal network hosts, enabling blind reconnaissance of otherwise unreachable services.

Affected Products

Ghost (Node.js CMS) version 6.54.1
Ghost versions after 6.54.1 and prior to 6.65.0
Self-hosted Ghost deployments within the affected range

Discovery Timeline

2026-10-05 - CVE-2026-105647 published to NVD
2026-10-06 - Last updated in NVD database
Fixed in - Ghost release v6.65.0

Technical Details for CVE-2026-105647

Vulnerability Analysis

The vulnerability resides in Ghost's handling of inbound functionality that triggers outbound HTTP fetches, including Webmentions and related URL lookups. When a remote user supplies a URL, Ghost performs an HTTP request against that URL without sufficient validation to prevent targeting internal network destinations. Because the request is executed by the server, attackers can reach hosts that are otherwise unreachable from the public internet, such as metadata services, internal admin consoles, or private APIs. The response body is not returned to the caller, so this is a blind SSRF primitive useful for host enumeration, port probing, and side-effect triggering rather than direct data exfiltration.

Root Cause

The underlying issue is incomplete validation of destination URLs before issuing server-side HTTP requests. The patch in commit 3f8594eb53de883ac017545c358f59039cb152de routes outbound fetches through externalRequest, which enforces network-level restrictions, and limits reads to the first chunk of the response body. This change ensures favicon and oEmbed-related lookups cannot be redirected toward private address ranges.

Attack Vector

An unauthenticated attacker submits a crafted URL to a Ghost endpoint that triggers server-side URL retrieval. Ghost then issues an HTTP request to the supplied host, which may resolve to an internal IP address, a loopback interface, or a cloud metadata endpoint. While no body is returned, response timing, errors, and side effects can disclose whether an internal service exists.

javascript

// Patch excerpt from ghost/core/core/server/services/oembed/oembed-service.js
// Routes outbound fetches through externalRequest and reads only the first chunk.
fetchFirstChunk(url) {
  return new Promise((resolve, reject) => {
    const stream = this.externalRequest.stream(url, {
      headers: {
        'user-agent': USER_AGENT,
        range: 'bytes=0-0',
      },
      timeout: {
        request: DEFAULT_REQUEST_TIMEOUT,
      },
      decompress: false,
      throwHttpErrors: false,
    });
    let response;

    stream.on('response', (res) => {
      response = res;
    });
    stream.once('data', (chunk) => {
      stream.destroy();
    });
  });
}

Source: GitHub Commit 3f8594e

Detection Methods for CVE-2026-105647

Indicators of Compromise

Outbound HTTP requests from the Ghost application process targeting RFC1918 address space, link-local addresses, or 169.254.169.254 metadata endpoints.
Repeated Webmention or oEmbed submissions from a single source containing URLs that resolve to internal hostnames.
Unusual DNS resolution patterns from the Ghost host for low-TTL or short-lived domains.

Detection Strategies

Inspect Ghost application logs for Webmention and oEmbed request handlers receiving URLs that resolve to private ranges or non-standard ports.
Correlate inbound unauthenticated POST requests to webmention endpoints with outbound socket connections initiated by the Ghost Node.js process.
Deploy egress proxy logging to capture every outbound HTTP request made by the Ghost server for retrospective analysis.

Monitoring Recommendations

Alert on any outbound connection from the Ghost workload to internal subnets, loopback, or cloud metadata IPs.
Monitor Ghost process network telemetry for anomalous destination diversity after public Webmention traffic spikes.
Track installed Ghost versions across the fleet and flag any instance running between 6.54.1 and 6.64.x.

How to Mitigate CVE-2026-105647

Immediate Actions Required

Upgrade all Ghost instances to version 6.65.0 or later, as documented in the Ghost v6.65.0 release notes.
Review GitHub Security Advisory GHSA-322m-ff4g-9vx9 for vendor guidance and acknowledgments.
Audit historical outbound traffic from Ghost servers for prior probing of internal hosts.

Patch Information

The fix is delivered in Ghost 6.65.0 via commit 3f8594eb53de883ac017545c358f59039cb152de and Pull Request #30918. The patch routes outbound favicon and oEmbed lookups through the validated externalRequest client and limits body reads to a single chunk, blocking SSRF against internal targets.

Workarounds

Place the Ghost server behind an egress proxy that denies outbound requests to private, loopback, and metadata address ranges.
Disable Webmentions and any related inbound URL-triggered features until the upgrade can be applied.
Apply host-level firewall rules preventing the Ghost process from initiating connections to internal subnets.

bash

# Example iptables egress restriction for the Ghost process user (uid 1000)
iptables -A OUTPUT -m owner --uid-owner 1000 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 127.0.0.0/8 -j REJECT