CVE-2026-105682: Ghost CMS SSRF Vulnerability in Webhooks

CVE-2026-105682 Overview

CVE-2026-105682 is a Server-Side Request Forgery (SSRF) vulnerability in Ghost, a Node.js content management system. The flaw affects versions 1.18.0 through 6.26.x and resides in the webhooks feature. An authenticated staff user can configure a webhook pointing to an internal address, causing the Ghost server to issue outbound requests to internal hosts. This enables attackers to probe internal network resources that should not be reachable from the public attack surface. The issue is tracked under [CWE-918] and fixed in Ghost 6.27.0.

Critical Impact
Authenticated staff users can abuse the webhooks feature to probe internal hosts reachable from the Ghost server, exposing internal network topology and services.

Affected Products

Ghost (Node.js CMS) versions 1.18.0 through 6.26.x
Self-hosted Ghost deployments where staff accounts exist
Deployments without allowWebhookInternalIPs set to false

Discovery Timeline

2026-10-05 - CVE-2026-105682 published to NVD
2026-10-06 - Last updated in NVD database
Fixed in - Ghost release v6.27.0

Technical Details for CVE-2026-105682

Vulnerability Analysis

The vulnerability lives in the webhook trigger service at ghost/core/core/server/services/webhooks/webhook-trigger.js. Ghost permitted staff users to register webhook target URLs without validating whether the destination resolved to an internal IP range. When a webhook event fired, the Ghost server performed an outbound HTTP request from its own network context. An attacker with staff privileges could point a webhook at RFC1918 addresses, loopback interfaces, cloud metadata endpoints, or other internal services. Even with limited response visibility, differences in response timing and error behavior leak information about reachable hosts and open ports.

Root Cause

Ghost did not restrict webhook destinations to external addresses by default. The configuration lacked an allowWebhookInternalIPs toggle, and the HTTP client used for webhook delivery did not filter resolved IP addresses against internal ranges before issuing requests.

Attack Vector

The attacker must hold a staff account on the target Ghost instance. From the admin interface or Admin API, the attacker creates or modifies a webhook pointing at an internal URL such as http://169.254.169.254/latest/meta-data/ or http://10.0.0.1:8080/. Triggering an event that fires the webhook causes Ghost to issue the outbound request from the server itself.

javascript

// Patch: ghost/core/core/server/services/webhooks/webhook-trigger.js
 const debug = require('@tryghost/debug')('services:webhooks:trigger');
 const logging = require('@tryghost/logging');
 const ghostVersion = require('@tryghost/version');
+const config = require('../../../shared/config');
 const crypto = require('crypto');

 class WebhookTrigger {

Source: GitHub Ghost Commit 815962d

Detection Methods for CVE-2026-105682

Indicators of Compromise

Webhook configurations in the Ghost database with target URLs pointing to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16)
Outbound connections from the Ghost application host to cloud metadata endpoints such as 169.254.169.254
Unexpected creation or modification of webhooks by staff accounts in Ghost audit logs

Detection Strategies

Query the Ghost webhooks table for target_url values resolving to internal addresses or non-routable hostnames
Inspect application and reverse proxy logs for webhook delivery attempts to private IP space
Correlate webhook creation events in Ghost admin logs with subsequent outbound connections from the host

Monitoring Recommendations

Alert on egress traffic from the Ghost server destined to internal subnets or cloud metadata IPs
Monitor the Admin API endpoints responsible for webhook CRUD operations for anomalous staff activity
Track installed Ghost version against 6.27.0 or later across your fleet

How to Mitigate CVE-2026-105682

Immediate Actions Required

Upgrade all Ghost instances to version 6.27.0 or later
Audit existing webhook configurations and remove entries pointing to internal addresses
Review staff account rosters and revoke accounts that no longer require access

Patch Information

The fix is included in Ghost v6.27.0. The patch introduces an allowWebhookInternalIPs configuration flag in ghost/core/core/shared/config/defaults.json, defaulting to false. See the GitHub Security Advisory GHSA-354h-gmhv-mr9c and the commit for implementation details.

Workarounds

Place the Ghost server behind an egress firewall that blocks outbound connections to internal networks and cloud metadata endpoints
Restrict staff role assignment to trusted operators until the patch is applied
Use IMDSv2 on AWS to require session tokens for metadata access

bash

# Ghost configuration (config.production.json) after upgrade
{
  "security": {
    "allowWebhookInternalIPs": false,
    "staffDeviceVerification": true
  }
}