Ghost CMS CVE-2026-53945

The attacker must be able to trigger a Ghost feature that issues an outbound HTTP request to an attacker-controlled hostname - examples include configuring a webhook URL, submitting an RSS feed URL for import, or invoking a custom integration. The CVSS vector (PR:N) indicates this can be achieved without authenticating to Ghost, though the specific unauthenticated feature vector should be confirmed against the full vendor advisory. Beyond the Ghost interaction, the attacker must control a DNS server capable of serving responses with very short TTLs and switch the A record from a public IP to a private/internal target within the window between Ghost's IP-validation check and the subsequent TCP connection. Exploitation is constrained by this high timing precision (AC:H) and the requirement for DNS infrastructure control. Ghost versions 6.21.1 and later are not affected.

The official CVSS 3.1 score is 4.0 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N. The High attack complexity (AC:H) accurately captures the non-trivial prerequisites: the attacker must control DNS infrastructure with sub-TTL switching capabilities and win a race condition between Ghost's check and its TCP handshake. The Scope Changed (S:C) flag is substantively important - exploitation allows Ghost to reach internal hosts such as cloud metadata endpoints (169.254.169.254), internal APIs, or adjacent containers that should be network-isolated. The official vector rates C:N, but SSRF-class access to internal hosts typically allows at least probing responses, suggesting C:L may better reflect realistic impact; this discrepancy should be verified against the vendor's analysis of which Ghost features expose fetch responses to the requester. No CISA KEV listing and no public exploit code identified at time of analysis; no EPSS data was provided, so exploitation probability cannot be quantified. Practical risk is elevated for Ghost deployments co-located with sensitive internal services but substantially reduced by AC:H for opportunistic attackers.

An attacker registers a domain and configures its authoritative DNS to serve a public IP with an extremely short TTL. They trigger a Ghost feature (such as a webhook endpoint or integration fetch) pointing at that domain; Ghost resolves the name, sees a public IP, and passes its private-IP check. The attacker simultaneously flips the DNS record to an internal target (e.g., 169.254.169.254 or an internal database host); Ghost's HTTP client then connects to the internal address, bypassing SSRF protections. No public exploit code has been identified at time of analysis, and the timing-dependent nature of the attack limits casual exploitation.