{"metadata": {"vulnerability": "CVE-2026-70594", "count": 15, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-04T19:50:27.327Z", "date_only": false, "value": "2026-08-04T19:50:27.327Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-70594", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-04T21:53:45.589Z", "date_only": false, "value": "2026-08-04T21:53:45.589Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-70594", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-04T21:53:45.589Z", "date_only": false, "value": "2026-08-04T21:53:45.589Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-70594", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-04T21:53:53Z", "date_only": false, "value": "2026-08-04T21:53:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7MPP-R37J-X5WH", "record": "GHSA-7MPP-R37J-X5WH", "field": "published"}, {"timestamp": "2026-08-04T21:53:53Z", "date_only": false, "value": "2026-08-04T21:53:53Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7MPP-R37J-X5WH", "record": "GHSA-7MPP-R37J-X5WH", "field": "modified"}, {"timestamp": "2026-08-04T22:17:17.423Z", "date_only": false, "value": "2026-08-04T22:17:17.423", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70594", "record": "FKIE_CVE-2026-70594", "field": "published"}, {"timestamp": "2026-08-04T22:36:37.367Z", "date_only": false, "value": "2026-08-04T22:36:37.367181Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6f6e3y6mttsbe", "record": "CVE-2026-70594", "field": "creation_timestamp", "uuid": "c33d4df6-041d-438f-9c96-e7a58a278b8c", "content": "CVE-2026-70594 - Ghost: Session Fixation in Ghost Admin\nCVE ID : CVE-2026-70594\n \n Published : Aug. 4, 2026, 9:53 p.m. | 22\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on l...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/6f6e3y6mttsbe"}, {"timestamp": "2026-08-05T01:31:27.427Z", "date_only": false, "value": "2026-08-05T01:31:27.427528Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/a8f899d9b938031c01419f5cf3be4d0e", "record": "CVE-2026-70594", "field": "creation_timestamp", "uuid": "3b47f3e3-5302-42e1-ba00-835b38e9fd53", "content": "# CVE-2026-70594: CVE-2026-70594: Session Fixation in Ghost Admin Panel\n\n> **CVSS Score:** 6.7\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70594\n\n## Summary\nA critical session fixation vulnerability exists in the Ghost Admin panel from version 2.2.0 until 6.54.1. The Express-based authentication backend fails to invalidate or rotate the session identifier during login, allowing attackers to hijack administrative sessions.\n\n## TL;DR\nGhost Admin did not rotate session identifiers upon login. This allowed session fixation attacks, enabling attackers with subdomain or domain-level cookie injection capabilities to hijack administrative sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-384\n- **Attack Vector**: Adjacent Network\n- **Attack Complexity**: High\n- **CVSS Score**: 6.7 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Content Management System (CMS)\n- Ghost Admin Panel\n- **Ghost**: >= 2.2.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.54.1 or newer\n- Enforce strict cookie domain and host isolation\n- Enable HttpOnly, Secure, and SameSite cookie policies\n\n**Remediation Steps:**\n1. Verify the current Ghost version using the command line\n2. Execute the `ghost update` command to install version 6.54.1 or higher\n3. Revoke all active sessions in the backend storage to invalidate existing un-regenerated session cookies\n\n## References\n\n- [Ghost Session Fixation Patch Commit](https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c)\n- [Ghost Security PR 29634](https://github.com/TryGhost/Ghost/pull/29634)\n- [GitHub Security Advisory GHSA-7mpp-r37j-x5wh](https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh)\n- [Ghost v6.54.1 Release Notes](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n- [CVE-2026-70594 Record](https://www.cve.org/CVERecord?id=CVE-2026-70594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70594) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/a8f899d9b938031c01419f5cf3be4d0e"}, {"timestamp": "2026-08-05T14:04:48.061Z", "date_only": false, "value": "2026-08-05T14:04:48.061296Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70594", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-05T14:04:48.061Z", "date_only": false, "value": "2026-08-05T14:04:48.061296Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70594", "record": "FKIE_CVE-2026-70594", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-05T14:05:02.863Z", "date_only": false, "value": "2026-08-05T14:05:02.863Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-70594", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-05T14:05:02.863Z", "date_only": false, "value": "2026-08-05T14:05:02.863Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70594", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-17T05:41:04.504Z", "date_only": false, "value": "2026-08-17T05:41:04.504Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GHOST-2026-70594", "record": "BIT-GHOST-2026-70594", "field": "published"}, {"timestamp": "2026-08-17T06:10:32.268Z", "date_only": false, "value": "2026-08-17T06:10:32.268Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GHOST-2026-70594", "record": "BIT-GHOST-2026-70594", "field": "modified"}, {"timestamp": "2026-09-08T20:51:43.490Z", "date_only": false, "value": "2026-09-08T20:51:43.490", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70594", "record": "FKIE_CVE-2026-70594", "field": "lastModified"}]}