New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
cPanel has patched a critical flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity.
Intelligence analysis by Llama
A critical flaw in cPanel has been patched, which allowed an authenticated hosting customer to execute SQL in the database's root context, potentially leading to operating-system-level compromise.
Imagine you have a superpower that lets you access any computer on the internet. A new flaw in cPanel, a popular tool for managing websites, lets hackers do just that. They can access the database of any website hosted on cPanel, which is a big deal because databases contain sensitive information like passwords and credit card numbers. The good news is that cPanel has patched the flaw, so websites should be safe again.
Analysis
A Critical Flaw in cPanel's Database-Renaming Process
The vulnerability, tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4), affects all supported versions of cPanel & WHM, as well as WP Squared. It allows an authenticated hosting customer to execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity.
According to the company's database documentation, the system creates a replacement database, moves the original data, recreates grants and stored code, and then removes the old database and its grants. However, the failure sits in cPanel's database-renaming process, where SQL mode is not preserved when a database is renamed, causing SQL to execute in root context.
The HackerOne CNA record says the same defect as CWE-89, SQL injection. The two records describe one bug from different angles. The advisory and CVE record do not identify the injected input, the affected SQL mode or the exact payload. Nor does it say whether Team User sub-accounts, the role-limited logins an account owner can create, meet its description of an authenticated account holder if they hold database access.
A Critical rating is a severity measure. It does not say how many servers have somebody in a position to use the flaw, and here that population is set by who holds accounts on the box: a server whose accounts all belong to one company is a different proposition from one selling accounts to strangers. The line is not clean, since accounts can be phished or resold. And it narrows nothing about consequence, which CISA rated total.
Patching the Flaw
The vendor has patched the flaw in the following builds: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. Servers that cannot update immediately can temporarily revoke the MySQL feature from cPanel users, leaving existing databases running but preventing users from adding or removing databases. Administrators can update from WHM or use the command documented by cPanel: /usr/local/cpanel/scripts/upcp --force.
Workaround for Busy Servers
For busy servers, the workaround is to disable backend connection reuse by setting cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restarting cpsrvd. cPanel says the workaround forces a new TCP and TLS connection for each request on ports 2083, 2087, and 2096, increasing latency and CPU use on busy servers.
Additional Vulnerabilities
The same build also patches CVE-2026-58047 (CVSS 4.0 score: 5.6), an HTTP request-smuggling issue in cpsrvd, the daemon that serves the cPanel and WHM interfaces. Under limited conditions, an unauthenticated remote attacker may manipulate responses delivered to other users on the same server. The CNA record says credentials could leak as a result. The workaround is to disable backend connection reuse by setting cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restarting cpsrvd.
Additionally, the same build patches GCVE-25-2026-07-45-3 in Exim, a local user's .forward file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. Under cPanel's default configuration, the expansion and execution occur as the cPanel user, which the company says may allow privilege escalation from Team User sub-accounts. Exim's advisory says exploitation requires a redirect router providing .forward handling, an accessible pipe transport, force_command enabled on that transport, and execution as a privileged user. Exim 4.99.5 removes the vulnerable expansion.
Key points
- cPanel has patched a critical flaw that allows an authenticated hosting customer to execute SQL in the database's root context.
- The flaw affects all supported versions of cPanel & WHM, as well as WP Squared.
- The vulnerability is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and is rated Critical.
- The patching of the flaw is a positive development, as it prevents hackers from accessing sensitive information.
- The workaround for busy servers, which involves disabling backend connection reuse, may help to mitigate the impact of the flaw.
The patching of the cPanel flaw is a positive development, as it prevents hackers from accessing sensitive information. Additionally, the workaround for busy servers, which involves disabling backend connection reuse, may help to mitigate the impact of the flaw.
The fact that the flaw was not detected earlier is a concern, as it may indicate a lack of attention to security. Additionally, the workaround for busy servers may increase latency and CPU use, which could have negative consequences.
