# Ghost CMS Content API SQL Injection CVE-2026-26980 — Large-Scale ClickFix Watering-Hole Campaign Compromising 700+ Domains (XLab) > Multi-cluster threat activity is exploiting CVE-2026-26980, an unauthenticated SQL injection in Ghost CMS Content API (slug filter), to dump Admin API Keys and inject malicious JavaScript loaders into article pages. The poisoned pages serve a cloaked second-stage that displays a fake Cloudflare verification overlay (ClickFix), tricking visitors into pasting attacker commands into Windows Run. XLab confirmed 700+ compromised domains including Harvard, Oxford, Auburn, and DuckDuckGo, with payloads ranging from DLL loaders to an Electron-based UtilifySetup.exe. - **Published:** 2026-05-24T00:00:00Z - **Last reviewed:** 2026-09-27T02:43:58.262Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0575 - **ID:** TL-2026-0575 - **Severity:** CRITICAL (CVSS 9.4) - **Category:** VULNERABILITY - **Status:** ACTIVE - **Actor:** Multi-cluster - **Detections:** 9 · **IOCs:** 61 (full data via the Threadlinqs MCP server — Purple tier) - **CVEs:** CVE-2026-26980 ## Description Ghost is a Node.js content management system used by news publishers, universities, and corporate sites. CVE-2026-26980 is an unauthenticated SQL injection in the Content API endpoint GET /ghost/api/content/posts/, rooted in slug-filter-order.js. The function parses slug:[a,b,c] expressions from NQL (Ghost Query Language) filters and concatenates the slug values directly into a raw SQL CASE WHEN ... END ASC fragment used in ORDER BY, with no parameterization. Because NQL's STRING token grammar is more permissive than slugFilterOrder's naive comma split, an attacker can use SQL concatenation operators (||) to stitch attacker-controlled SQL into the ORDER BY clause, enabling arbitrary database reads, including disclosure of the admin_api_keys table. The Content API key required to reach the endpoint is embedded in theme HTML and effectively public. Versions 3.24.0 through 6.19.0 are affected; 6.19.1 (released 2026-02-19) fixes the issue. Exploitation chain. (1) Unauthenticated SQLi against /ghost/api/content/posts/?filter=slug:[...] returns the Admin API Key. (2) The attacker uses the Admin API Key to call PUT /ghost/api/admin/posts/:id/ and append a small JavaScript loader to the bottom of published articles. The loader is highly recognisable: it base64-decodes a hard-coded stage-2 URL using atob() and POSTs the page origin back using btoa(a.origin). (3) The stage-2 cloaking script fingerprints the visitor (user-agent, geo, prior visit cookies) and decides whether to serve the lure. (4) Qualifying visitors are served a full-screen iframe overlay impersonating Cloudflare's Just-A-Moment human-verification page (FakeCaptcha / ClickFix). The overlay instructs the victim to open Windows Run (Win+R), paste a clipboard-staged command, and press Enter. (5) The clipboard command pulls a ZIP from attacker infrastructure (update.zip, NotepadPlusPlus.zip), expands it, and executes the bundled installer.dll / NotepadPlusPlus.dll via rundll32 or a .cmd/.js launcher. Observed second-stage payloads include the Electron-packaged UtilifySetup.exe (Inno Setup wrapper) and SuperAppizeSetup.msi, which deploy pay-per-install ad/loader malware (sup.exe, publl.dll). Threat clustering. XLab tracks at least two distinct clusters operating on overlapping target sets. Cluster A uses domains clo4shara[.]xyz, com-apps[.]cc, platecrumbs[.]com (all serving the same /11z77u3.php cloaking script), with payload-staging on cloud-verification[.]com, jalwat[.]com, and taketwolabs[.]com. Cluster B uses the staticcloudflare[.]pro / script-dev[.]digital / script-dev[.]buzz / updatesecurity[.]pro / updatefilescf[.]top family, all sharing the /api/css.js stage-2 URI pattern and partially resolving to 144.31.236.66. The two clusters have been observed cleaning up each other's injected scripts on shared victims and reinfecting, indicating ongoing competition rather than coordination. Scale and victims. As of XLab's 2026-05-17 enumeration, 700+ live compromised Ghost sites carried the injected loader, up from 156 sites on 2026-05-10. Named victim sites include Harvard University, Oxford University, Auburn University, and DuckDuckGo. The campaign is opportunistic mass exploitation, not targeted intrusion, and effectively turns each compromised CMS into a watering-hole for visitor-side ClickFix social engineering. Remediation. Upgrade Ghost CMS to >= 6.19.1 immediately. Because Admin API Keys were almost certainly disclosed on any pre-patch Internet-exposed instance, rotate ALL credentials (Admin API Key, Content API Key, administrator passwords, active sessions) after upgrade. Audit posts, snippets, and themes for injected