AI Threat Alert
### Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but [Device Verification](https://docs.ghost.org/security#device-verification) should have prevented an...
Full CISO analysis pending enrichment.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Microsoft APM | npm | < 6.54.1 | 6.54.1 |
Do you use Microsoft APM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
Patch available
Update Microsoft APM to version 6.54.1
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-70590?
### Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but [Device Verification](https://docs.ghost.org/security#device-verification) should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. ### Vulnerable versions This vulnerability is present in Ghost versions v6.54.0 and earlier. ### Patches v6.54.1 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). ### Workarounds If upgrading immediately is not possible, ensure all staff users have [Multi-factor Authentication](https://docs.ghost.org/security#email-2fa) (MFA) enabled. This will help prevent an attacker from logging in with any passwords that are successfully recovered from the leaked hashes. ### References Ghost thanks Chapman Schleiss for disclosing this vulnerability responsibly. ### For more information If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).
Is CVE-2026-70590 actively exploited?
No confirmed active exploitation of CVE-2026-70590 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-70590?
Update to patched version: Microsoft APM 6.54.1.
What is the CVSS score for CVE-2026-70590?
CVE-2026-70590 has a CVSS v3.1 base score of 4.8 (MEDIUM).
What are the technical details?
Original Advisory
### Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but [Device Verification](https://docs.ghost.org/security#device-verification) should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. ### Vulnerable versions This vulnerability is present in Ghost versions v6.54.0 and earlier. ### Patches v6.54.1 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). ### Workarounds If upgrading immediately is not possible, ensure all staff users have [Multi-factor Authentication](https://docs.ghost.org/security#email-2fa) (MFA) enabled. This will help prevent an attacker from logging in with any passwords that are successfully recovered from the leaked hashes. ### References Ghost thanks Chapman Schleiss for disclosing this vulnerability responsibly. ### For more information If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).
Weaknesses (CWE)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Primary
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-46858 9.1 Oracle APM: unauthenticated write/DoS via JVM Diagnostics
Same package: apm CVE-2026-57947 8.5 Pinpoint APM: SSRF via alarm webhook registration
Same package: apm CVE-2026-45539 7.4 Microsoft APM: symlink attack leaks host files in agent deps
Same package: apm CVE-2026-57948 6.8 Pinpoint: insecure JWT cookie enables session hijacking
Same package: apm CVE-2026-49835 5.9 Sigstore TSA: unbounded metrics label DoS
Same package: apm