CVE-2026-53943 Details

A cache poisoning vulnerability has been identified in Ghost, a Node.js content management system, affecting versions 4.0.0 prior to 6.36.0. The issue arises when Ghost is behind a shared caching layer that distributes cached content among different visitors. In these configurations, an unauthenticated user can send an x-ghost-preview header that modifies the rendered frontend response. This altered response may be cached and served to subsequent visitors, poisoning the cache with request-specific preview output. If Ghost's frontend and admin panel are on the same domain, this vulnerability could be exploited to take over staff user accounts. However, if they are on different domains, there is no exposure.

Users can update to Ghost version 6.37.0, which addresses this vulnerability. For self-hosters using Docker, instructions for updating a Docker-based Ghost instance are available in the Ghost documentation. If Ghost is installed using Ghost-CLI, see the documentation on updating to the latest version. If a credential compromise is suspected, use the 'Reset all authentication' dialogue under Settings / Danger Zone, available starting with Ghost v6.41.0.