Executive brief
Ghost-CLI, a tool used to install and manage the Ghost publishing platform, contains a configuration flaw in its default setup for self-hosted servers. This flaw allows attackers to hide their true identity by spoofing their IP address, which enables them to bypass security protections designed to limit repeated login attempts or automated spam. While this does not directly expose private data, it makes the server more vulnerable to brute-force attacks and service abuse.
Technical details
Ghost-CLI versions prior to 1.30.1 generate a default Nginx configuration that uses the $proxy_add_x_forwarded_for directive. This directive appends the client's IP to any existing X-Forwarded-For header provided in the request; because the proxy does not validate or overwrite the incoming header, an attacker can inject arbitrary IP addresses into the chain. By presenting a different IP address for each request, an unauthenticated remote attacker can circumvent rate-limiting mechanisms that rely on IP tracking. The vulnerability affects self-hosted instances installed via the CLI. A fix is available in version 1.30.1, which changes the configuration to use $remote_addr, and manual configuration updates are recommended for existing installations.
Affected products
- TryGhost Ghost-CLI < 1.30.1
Timeline
- 2026-07-31: disclosed
- 2026-07-31: patched: Fixed in Ghost-CLI 1.30.1
- 2026-07-31: advisory