New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
cPanel patched CVE-2026-58048, a critical privilege escalation flaw (CVSS 9.4) allowing authenticated hosting customers to execute SQL commands with full database root/administrative privileges The vulnerability stems from SQL mode not being preserved during cPanel's database-renaming process, causing SQL to execute in root context and potentially leading to OS-level compromise Two additional vulnerabilities were addressed in the same release: CVE-2026-58047 (HTTP request smuggling in cpsrvd, CV
Analysis
TL;DR
- cPanel patched CVE-2026-58048, a critical privilege escalation flaw (CVSS 9.4) allowing authenticated hosting customers to execute SQL commands with full database root/administrative privileges
- The vulnerability stems from SQL mode not being preserved during cPanel's database-renaming process, causing SQL to execute in root context and potentially leading to OS-level compromise
- Two additional vulnerabilities were addressed in the same release: CVE-2026-58047 (HTTP request smuggling in cpsrvd, CVSS 5.6) and two Exim flaws (unsafe string expansion and directory traversal)
- CISA rated the technical impact as "total" but initially recorded "exploitation: none" and classified the flaw as non-automatable, though this snapshot may not reflect current reality
- Affected builds span multiple supported cPanel & WHM branches (11.110 through 11.136) plus WP Squared 138.1.6, with temporary workarounds available for servers unable to update immediately
Why It Matters
This vulnerability represents a fundamental breakdown in the multi-tenant hosting security model, where the privilege boundary between individual cPanel accounts and the server's administrative database identity was crossed, potentially allowing any authenticated user to escalate to full server compromise. For AI practitioners and infrastructure teams relying on shared hosting environments, this underscores the critical importance of keeping web hosting control panels patched, as a single vulnerable component can undermine the entire isolation model that multi-tenant architectures depend on.
Technical Details
- CVE-2026-58048 (CVSS 9.4): The core flaw exists in cPanel's database-renaming process, which creates a replacement database, moves original data, recreates grants and stored code, then removes the old database — but fails to preserve SQL mode, causing subsequent operations to execute in the database administrative/root context. This bypasses cPanel's normal database-level privilege restrictions that do not require SUPER access.
- CVE-2026-58047 (CVSS 5.6): An HTTP request-smuggling vulnerability in cpsrvd (the daemon serving cPanel and WHM interfaces) that allows unauthenticated remote attackers to manipulate responses delivered to other users on the same server under limited conditions, potentially leaking credentials.
- Exim vulnerabilities (GCVE-25-2026-07-45-3 and GCVE-25-2026-07-45-1): The first involves unsafe string expansion in the .forward file redirect router under certain pipe-transport configurations, enabling privilege escalation from Team User sub-accounts; the second is a High-severity local directory traversal through queue-name command-line arguments in Exim 4.99.5.
- Patched builds: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and WP Squared 138.1.6. Notably, cPanel's advisories are inconsistent — the 11.118 branch appears in the database advisory but is omitted from the request-smuggling and Exim advisory lists.
- Workarounds: For CVE-2026-58048, temporarily revoke the MySQL feature from cPanel users (existing databases remain functional). For CVE-2026-58047, set cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restart cpsrvd, though this increases latency and CPU usage.
Industry Insight
- The discrepancy between cPanel's advisory language (calling it a "privilege escalation") and the CNA classification (CWE-89 SQL injection) highlights the importance of cross-referencing multiple vulnerability records — practitioners should check both the vendor advisory and the CVE/CNA records for complete technical details, as neither alone identifies the exact payload, affected SQL mode, or injected input.
- The inconsistency in patched build listings across advisories published in the same release is a red flag for operational security; administrators should verify their installed point release against every relevant advisory rather than relying on a single source, and consider implementing automated build-verification checks in their patch management workflows.
- CISA's "exploitation: none" assessment on August 4 should not be treated as a current status — the article itself notes this is merely a snapshot with no guarantee about the days since; organizations should treat this as an actively exploitable critical flaw and prioritize patching immediately, especially on servers with externally-sold hosting accounts where the attack surface is significantly broader.
Disclaimer: The above content is generated by AI and is for reference only.