A critical security vulnerability patched in cPanel could allow authenticated web hosting users to cross privilege boundaries and execute arbitrary SQL commands with full database administrative (root) privileges.
The bug, tracked under CVE-2026-58048 with a CVSS 4.0 score of 9.4, impacts all supported versions of cPanel & WHM, as well as WP Squared. Depending on the host’s operating system and database configuration, security experts warn that exploitation could lead to full operating-system-level compromise.
Key Highlights & Technical Details
1. What Is CVE-2026-58048?
- The Vulnerability: Under standard cPanel operations, user accounts are constrained to restricted, database-level permissions. CVE-2026-58048 breaks these constraints by forcing SQL execution in the administrative root context during database-renaming processes.
- Root Cause: When renaming a database, cPanel fails to preserve the active SQL mode. As cPanel rebuilds grants, moves data, and recreates stored code, the underlying execution shifts into the database root context.
- Classification: Classified as a privilege escalation defect by cPanel and categorized under CWE-89 (SQL Injection) in HackerOne records.
2. Additional Flaws Disclosed in the Same Patch
cPanel’s targeted security release addressed two other notable vulnerabilities:
- CVE-2026-58047 (CVSS 5.6): An HTTP request-smuggling vulnerability in `cpsrvd` (the daemon serving cPanel and WHM interfaces). Under specific conditions, unauthenticated remote attackers can manipulate HTTP responses and potentially leak credentials.
- GCVE-25-2026-07-45-3 (Exim Vulnerability): An unsafe string expansion bug in Exim’s redirect router via `.forward` files, allowing local sub-accounts (such as Team User accounts) to escalate privileges under cPanel’s default configuration.
Affected Builds & Remediation
Patched Versions
cPanel has patches across all supported release branches:
`11.110.0.137` `11.118.0.71` `11.126.0.78` `11.134.0.48` `11.136.0.32` `138.1.6` (for WP Squared)
Administrators can force an immediate update from WHM or via CLI:
```bash /usr/local/cpanel/scripts/upcp --force
Temporary Workarounds
- For CVE-2026-58048: Temporarily revoke the MySQL feature from cPanel feature lists. Existing databases will continue running normally, but account holders will be unable to add, rename, or delete databases.
- For CVE-2026-58047: Disable backend connection reuse by setting `cpsrvd_keepalives_disabled=1` in `/var/cpanel/cpanel.config` and restarting `cpsrvd`. (Note: This forces fresh TCP/TLS connections for requests, which may moderately increase server CPU and latency).
Impact Summary for Administrators
Shared hosting providers face the highest relative risk, as attackers only need valid credentials (or a phished/resold hosting sub-account) to exploit the flaw. System administrators are strongly advised to update servers to the latest point release immediately.
