MEDIUM 5.8 GitHub
CVE-2026-53944
Ghost: Private IP filtering bypass to make server-side requests to internal services
### Impact
When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address.
### Vulnerable versions
This vulnerability is present in Ghost from v6.0.9 up to v6.21.0.
### Patches
v6.21.1 contains a fix for this issue.
### How to update
For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based G
Affected Products
- npm/ghost >= 6.0.9, <= 6.21.0
References
- https://github.com/advisories/GHSA-wvp2-4qqp-4h3r
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-wvp2-4qqp-4h3r
- https://nvd.nist.gov/vuln/detail/CVE-2026-53944
- https://github.com/TryGhost/Ghost/pull/26749
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-08-04 via GitHub. Affected: npm/ghost >= 6.0.9, <= 6.21.0.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.