CVE-2026-53943: Ghost CMS cache poisoning via x-ghost-preview header
Ghost, the Node.js content management system, before 6.37.0 let unauthenticated users alter rendered frontend responses with an x-ghost-preview header, which a shared cache could then serve to other visitors. When the frontend and admin panel share a domain, this could lead to staff account takeover. The issue is fixed in 6.37.0 and is rated CVSS 3.1 9.6 (critical).
Overview
CVE-2026-53943 affects Ghost, a Node.js content management system. Before version 6.37.0, an unauthenticated user could send an x-ghost-preview header that changed the rendered frontend response. If Ghost sits behind a shared caching layer (a CDN or reverse proxy that serves the same cached content to different visitors), that request-specific preview output could be stored and served to later visitors of the same page. The weakness is classified as CWE-524. Details come from the GitHub security advisory.
Impact
The CNA (GitHub) scores this issue CVSS 3.1 9.6 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: network-reachable, low complexity, no privileges required, user interaction required and changed scope. The most serious consequence applies when the Ghost frontend and admin panel are served from the same domain: the advisory states the flaw could then be used to take over staff user accounts. When frontend and admin run on different domains, staff accounts are stated to have no exposure, although poisoned content could still be served to visitors in affected cache setups.
Affected products and versions
- Ghost versions before 6.37.0, when deployed behind a shared cache that shares cached responses across visitors.
- The lower bound of the affected range is not specified in the record.
- Fixed in 6.37.0.
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.
Remediation and mitigation
- Upgrade Ghost to 6.37.0 or later.
- If you cannot upgrade immediately, review your caching layer so that the x-ghost-preview header from untrusted clients is stripped before reaching Ghost, or ensure responses influenced by it are not cached and shared.
- Consider serving the admin panel on a separate domain from the public frontend, which the advisory indicates removes staff account exposure.
- After patching, purge shared caches to remove any potentially poisoned entries.
Detection guidance
- Review web server, proxy or CDN logs for unauthenticated requests carrying the x-ghost-preview header.
- Look for unexpected preview-style content served from public cached pages.
- Audit staff accounts for unexpected sessions, permission changes or credential changes, especially where frontend and admin share a domain.
Limitations of the available information
The record does not specify the first affected version, does not include structured affected-product or fix data, and provides no EPSS or SSVC information. NVD lists the entry as Deferred. Technical details on exactly how the poisoned response enables account takeover are not described in the record.
Frequently asked questions
Which Ghost version fixes CVE-2026-53943?
The advisory states the vulnerability is fixed in Ghost 6.37.0.
Are all Ghost sites at risk?
Risk depends on deployment: the issue requires a shared caching layer that serves cached content across visitors, and staff account takeover is only possible when the frontend and admin panel share the same domain.
Is CVE-2026-53943 being exploited?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.