Critical cPanel Vulnerability: A Hosting Customer Could Run SQL as the Database Root

cPanel has shipped a targeted security update that closes a critical vulnerability, CVE-2026-58048 (CVSS 4.0 — 9.4). The flaw allowed an authenticated hosting customer to step outside their own account and run SQL queries in the context of the database server's administrative account.

The vulnerability affects all supported versions of cPanel & WHM, as well as the WP Squared product. Exploitation requires a valid cPanel account and access to the MySQL/MariaDB feature. From there the account holder could execute arbitrary commands with full administrative rights, and depending on the OS and DBMS configuration, things could even escalate to a compromise at the operating-system level.

Where the root of the problem lies

The failure lies in the database rename procedure. According to the HackerOne record as CNA, the SQL mode is not preserved during the rename, so the query runs in root context. Per cPanel's documentation, the system creates a replacement database, migrates the data into it, recreates the privileges and stored code, and then drops the old database along with its grants — and that path is where the loophole opens up.

Curiously, the vendor's advisory calls the issue a privilege escalation and avoids the words “SQL injection,” whereas the CVE record classifies the same defect as CWE-89 — that is, injection precisely. It is one and the same flaw described from different angles. Neither the advisory nor the CVE record specifies the injected input, the affected SQL mode, or the exact payload. Nor does it clarify whether role-restricted Team User subaccounts with database access fall under the definition of an “account holder.”

In a note dated August 4, CISA recorded the status “exploitation: none,” rated the vulnerability as non-automatable but with full technical impact. That said, this is only a snapshot. How critical it is here depends largely on who owns the accounts on the server: a machine where all accounts are held by a single company is quite different from a server that sells access to strangers.

The patches landed in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. If updating right away isn't possible, you can temporarily revoke the MySQL feature from users: existing databases will keep working, but adding and deleting them will be blocked.

Two more flaws in the same release

CVE-2026-58047 (CVSS 5.6) — HTTP request smuggling in the cpsrvd daemon that serves the cPanel and WHM interfaces. Under certain conditions, an unauthenticated remote attacker can substitute responses delivered to other users of the same server, which risks leaking credentials. Both vulnerabilities were found by Vincent55 Yang.

The third advisory concerns Exim: a local user's .forward file can trigger unsafe string expansion in the redirect router under certain pipe transport configurations. The issue is fixed in Exim 4.99.5, which also closes a directory traversal via queue-name arguments.

One inconsistency is worth noting separately: cPanel's own advisories disagree on which builds contain the fixes — the 11.118 branch appears in one list and is absent from others. Users on that branch are advised to check against the database advisory rather than trust the shorter lists.

Source: The Hacker News