cPanel has addressed a critical security vulnerability, identified as CVE-2026-58048, which permitted authenticated hosting customers to execute SQL commands with root-level database privileges. This flaw effectively allowed users to bypass the standard privilege boundaries between individual cPanel accounts and the server’s administrative database identity.
The vulnerability affected all supported versions of cPanel & WHM, as well as WP Squared. Exploiting this flaw required a valid cPanel account with access to the MySQL or MariaDB feature. Once accessed, the account holder could execute arbitrary database commands with full administrative privileges. Depending on the server’s operating system and database engine configuration, this could potentially lead to a complete system compromise.
cPanel has released patches for the following versions to address this issue:
- 11.110.0.137
- 11.118.0.71
- 11.126.0.78
- 11.134.0.48
- 11.136.0.32
- 138.1.6 for WP Squared
Administrators are strongly advised to update their systems promptly. For servers that cannot be updated immediately, a temporary mitigation involves revoking the MySQL feature from cPanel users. This action will prevent users from adding or removing databases while allowing existing databases to continue functioning. Administrators can perform the update via the WebHost Manager (WHM) interface or by executing the following command:
/usr/local/cpanel/scripts/upcp --force
The Cybersecurity and Infrastructure Security Agency (CISA) has assessed this vulnerability, noting that while exploitation has not been observed, the technical impact is considered severe. Under normal circumstances, cPanel supports database-level privileges that do not require ‘SUPER’ access or allow global modifications. However, CVE-2026-58048 bypassed these restrictions by enabling SQL execution in the database’s administrative context.
The root cause of this vulnerability lies in cPanel’s database-renaming process. Specifically, the SQL mode was not preserved during the renaming operation, leading to SQL execution with root privileges. According to cPanel’s documentation, the renaming process involves creating a replacement database, transferring data from the original, recreating grants and stored procedures, and then removing the old database and its associated grants.
In addition to CVE-2026-58048, cPanel’s recent security release addressed two other vulnerabilities:
- CVE-2026-58047: An HTTP request-smuggling issue in ‘cpsrvd’, the daemon responsible for serving the cPanel and WHM interfaces. Under certain conditions, an unauthenticated remote attacker could manipulate responses delivered to other users on the same server, potentially leading to credential leakage.
- CVE-2026-58049: A privilege escalation vulnerability in the LiteSpeed cPanel Plugin, allowing authenticated cPanel users to execute arbitrary scripts as root. This issue affected versions up to v5.3.1 of the LiteSpeed WHM plugin.
These vulnerabilities underscore the importance of timely software updates and vigilant system administration. Hosting providers and server administrators should prioritize applying these patches to safeguard their systems against potential exploits. Additionally, implementing robust monitoring and access controls can help detect and mitigate unauthorized activities, ensuring the integrity and security of hosting environments.
