EUVD-2026-51595Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated; low confidentiality impact reflects rate-limit bypass enabling enumeration or brute-force; no integrity or availability impact from the bypass itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxy_add_x_forwarded_for directive to present an arbitrary IP address, circumventing Ghost's rate-limiting mechanisms on self-hosted instances.
AnalysisAI
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
Technical ContextAI
Ghost CLI (CPE: cpe:2.3:a:tryghost:ghost-cli:*:*:*:*:*:*:*:*) is the command-line management tool used to install, configure, and maintain self-hosted Ghost CMS deployments, including generation of Nginx reverse-proxy configuration files. The root cause is CWE-348 (Use of Less Trusted Source): Ghost's rate-limiting middleware trusts the X-Forwarded-For header to identify client IP addresses without enforcing validation across the full header chain. When Nginx is configured with proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for, the directive appends the connecting client's actual IP to any X-Forwarded-For values already present in the inbound request rather than overwriting them. An attacker can pre-populate that header with an arbitrary IP before the request reaches Nginx, causing Ghost to read the spoofed address as the effective client IP and resetting the per-IP rate-limit counter on each request. The misconfiguration is technically the Nginx directive choice - using $proxy_add_x_forwarded_for instead of $remote_addr - which Ghost CLI versions prior to 1.30.1 generated in their Nginx configuration templates.
RemediationAI
Upgrade Ghost CLI to version 1.30.1 or later, which is the vendor-confirmed patched release per the GitHub security advisory GHSA-wjx2-9fpq-8997 and the VulnCheck advisory at https://www.vulncheck.com/advisories/ghost-cli-ip-spoofing-via-x-forwarded-for-header. The fix corrects the Nginx configuration template generated by Ghost CLI to properly handle the X-Forwarded-For header chain. For operators who cannot upgrade immediately, the targeted compensating control is to replace $proxy_add_x_forwarded_for with $remote_addr in the Nginx proxy_set_header X-Forwarded-For directive; this discards any client-supplied header values and sets only the actual connecting IP, eliminating the spoofing vector. The trade-off is that legitimate upstream proxies in front of Nginx will no longer pass real client IPs downstream. Alternatively, configure Nginx's set_real_ip_from and real_ip_header directives to enforce trusted-proxy IP validation, accepting X-Forwarded-For only from known upstream proxy addresses - this preserves legitimate IP forwarding while rejecting attacker-controlled header values. Running ghost config or ghost setup after upgrading to 1.30.1 may be required to regenerate the corrected Nginx configuration.
Same weakness CWE-348 – Use of Less Trusted Source
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today