CVE-2026-70595: Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, s…
Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.
- Published by source
- 2026-08-05
- First seen by Reality Radar
- 2026-10-24
- Last verified
- 2026-10-24
What the official notice says
Risk: CVSS 4
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-08-05
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1530 | new | 2026-10-24 | 2e4d06635570…5dc827 | de85f8daa94a…758ea9 |
Chain head: #1648 cafd57e2dfc3…bbd03d