CVE-2026-105648 TryGhost CVE debrief

Who should care

Defenders and administrators of Ghost instances, especially self-hosted instances using Docker or Ghost-CLI, should assess exposure and prioritize updating to v6.65.0 or later. This vulnerability allows limited HTTP requests to internal network hosts on some Ghost configurations, potentially leading to unauthorized actions without response data return. Operators, platform administrators, and security teams should review and act on this advisory to mitigate

Why it matters

Defenders should care about CVE-2026-105648 because it allows unauthenticated users to make limited HTTP requests to internal network hosts on some Ghost configurations. This vulnerability is present in Ghost from v6.0.9 up to v6.64.0 and is fixed in v6.65.0. Defenders and administrators of Ghost instances, especially self-hosted instances using Docker or Ghost-CLI, should assess exposure and prioritize updating to v6.65.0 or later.

• Potential for unauthorized HTTP requests to internal network hosts
• Limited data exposure due to lack of response data return
• Need for verification of affected versions and exposure
• Priority for updating to v6.65.0 or later

Technical summary

A validation issue in Ghost allows unauthenticated users to make limited HTTP requests to internal network hosts on some configurations. The vulnerability is present in Ghost from v6.0.9 up to v6.64.0 and is fixed in v6.65.0. This issue enables attackers to bypass private IP filtering via IPv6 transition addresses, potentially leading to unauthorized HTTP requests to internal network hosts without response data being returned. Defenders should prioritize updating Ghost to v6.65.0 or later, especially for self-hosted instances using Docker or Ghost-CLI.

Defensive priority

Defenders should prioritize updating Ghost to v6.65.0 or later, especially for self-hosted instances using Docker or Ghost-CLI.

Recommended defensive actions

• Update Ghost to v6.65.0 or later
• Review and update self-hosted instances using Docker or Ghost-CLI
• Monitor for potential abuse of Webmentions functionality
• Verify affected versions and configurations
• Assess exposure and prioritize updates
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability allows limited HTTP requests to internal network hosts without returning response data. Affected versions are from v6.0.9 to v6.64.0, and the fix is in v6.65.0. This issue was responsibly disclosed by Nhat Anh Vu. The attack does not yield response data, making detection challenging. Defenders should verify affected versions and configurations, focusing on self-hosted instances.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.