Is CVE-2026-105804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105804 being exploited in the wild.

How severe is CVE-2026-105804?

Medium severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

payload (npm) SEMVER:introduced=3.0.0,fixed=3.90.0; Payload CMS 3.0.0 to 3.89.x, 4.0.0-canary.0 to 4.0.0-canary.33.

Is there a fix for CVE-2026-105804?

Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105804 attacked?

It is attacked with local access.

Am I affected by CVE-2026-105804?

Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105804: Payload CMS weak password hashing parameters

CVE-2026-105804 · Severity: medium · CVSS 4 · Published 2026-10-06

Payload is a headless content management system used to store and serve digital content for websites and applications. Affected versions use an inadequately configured password hashing algorithm that makes it easier for attackers to crack user passwords if they obtain the password hash database. This is a credential security issue that could lead to unauthorized account access.

Technologies: payload (npm), Payload CMS. Vendors: npm, Payload.

Quick answers

Is CVE-2026-105804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105804 being exploited in the wild.
How severe is CVE-2026-105804?: Medium severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: payload (npm) SEMVER:introduced=3.0.0,fixed=3.90.0; Payload CMS 3.0.0 to 3.89.x, 4.0.0-canary.0 to 4.0.0-canary.33.
Is there a fix for CVE-2026-105804?: Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105804 attacked?: It is attacked with local access.
Am I affected by CVE-2026-105804?: Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

payload (npm): upgrade to 3.90.0 or later
```
npm install payload@3.90.0
```

Technical details

Payload versions 3.0.0–3.89.x and 4.0.0-canary.0–4.0.0-canary.33 employ PBKDF2-SHA256 password hashing with a lower-than-recommended work factor, reducing the computational cost of brute-force attacks against recovered password hashes. No authentication or network interaction is required; the vulnerability only manifests when an attacker gains access to the password hash database. Upgraded versions increase the work factor and introduce versioned hash schemes that upgrade password hashes to current parameters on next successful login.

Affected products

Payload Payload CMS 3.0.0 to 3.89.x, 4.0.0-canary.0 to 4.0.0-canary.33

Identifiers

CVE-2026-105804
GHSA-q6mq-ch85-c8mm

Timeline

2026-10-06: disclosed
2026-09-18: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.