Is CVE-2026-29784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29784 being exploited in the wild.

How severe is CVE-2026-29784?

Low severity, with a CVSS score of 3.1, published 5 March 2026.

Which products and versions are affected?

ghost (npm) SEMVER:introduced=5.101.6,fixed=6.19.3.

Is there a fix for CVE-2026-29784?

Yes. ghost (npm): upgrade to 6.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29784 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-29784?

Check whether you run ghost (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29784: Ghost incomplete CSRF protections in OTC login

CVE-2026-29784 · Severity: low · CVSS 3.1 · Published 2026-03-05

Ghost is a popular content management system used to publish and manage websites and blogs. This vulnerability in the one-time code (OTC) login feature allows attackers to bypass cross-site request forgery protections, potentially enabling phishing attacks that could lead to unauthorized access to Ghost administration interfaces. Attackers could use this to take over a Ghost site with relatively low technical complexity but requiring user interaction.

Technologies: ghost (npm). Vendors: npm.

Quick answers

Is CVE-2026-29784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29784 being exploited in the wild.
How severe is CVE-2026-29784?: Low severity, with a CVSS score of 3.1, published 5 March 2026.
Which products and versions are affected?: ghost (npm) SEMVER:introduced=5.101.6,fixed=6.19.3.
Is there a fix for CVE-2026-29784?: Yes. ghost (npm): upgrade to 6.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29784 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-29784?: Check whether you run ghost (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ghost (npm): upgrade to 6.19.3 or later
```
npm install ghost@6.19.3
```

Technical details

This vulnerability is a cross-site request forgery (CSRF) protection bypass in Ghost's /session/verify endpoint that handles one-time code (OTC) verification during login. The incomplete CSRF protections allow an attacker to use OTCs in login sessions different from the requesting session, effectively decoupling the token from the session context it was intended for. The attack requires user interaction (a user must click a phishing link) and network access, but no authentication or special privileges. An attacker can exploit this via phishing to redirect a user's OTC authentication to an attacker-controlled session, gaining administrative access to the Ghost site. The fix is available in version 6.19.3.

Affected products

Ghost Ghost 5.101.6 to 6.19.2

Identifiers

CVE-2026-29784
GHSA-9m84-wc28-w895

Timeline

2026-03-05: disclosed: Vulnerability disclosed via GHSA-9m84-wc28-w895
2026-03-05: patched: Fix released in Ghost v6.19.3

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m84-wc28-w895

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.