CVE-2026-105647 TryGhost CVE debrief

Who should care

Defenders responsible for Ghost instances, particularly those using Webmentions functionality or with internal networks that may be affected by the vulnerability, should assess exposure and prioritize updates.

Why it matters

Defenders should care about CVE-2026-105647 because it allows unauthenticated users to make limited HTTP requests to hosts in the Ghost server's internal network, potentially leading to unauthorized requests and requiring verification of exposure and prioritization of updates.

• Potential for unauthorized HTTP requests to internal network hosts
• Limited data returned from successful attacks
• Need for verification of exposure in internal networks
• Priority for updating Ghost instances to version 6.65.0 or later

Technical summary

A validation issue in Ghost allowed unauthenticated users to make limited HTTP requests to hosts in the Ghost server's internal network via Webmentions. The vulnerability is present in Ghost from version 6.54.1 up to version 6.64.0, and is fixed in version 6.65.0. Defenders should prioritize updating Ghost instances to version 6.65.0 or later, and verify exposure in internal networks. The vulnerability allows limited HTTP requests without returning response data, requiring verification of exposure and prioritization of updates.

Defensive priority

Defenders should prioritize updating Ghost instances to version 6.65.0 or later, and verify exposure in internal networks.

Recommended defensive actions

• Update Ghost instances to version 6.65.0 or later
• Verify exposure in internal networks
• Monitor for potential abuse of Webmentions functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and patches. However, the CVSS score and severity are not provided. The vulnerability allows unauthenticated users to make limited HTTP requests to hosts in the Ghost server's internal network via Webmentions. A successful attack would not return response data. The vulnerability is present in Ghost from version 6.54.1 up to version 6.64.0, and is fixed in version 6.65.0. Defenders should verify exposure in internal networks and prioritize updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.