CVE-2026-58048, assigned a CVSS score of 9.4, lets an authenticated cPanel hosting customer execute SQL in the database’s root context — crossing the privilege boundary between a cPanel account and the server’s administrative database identity.
CVE-2026-58048: database root execution from a cPanel account
cPanel patched a flaw that allowed an authenticated hosting customer with access to the MySQL/MariaDB feature to execute arbitrary database commands with full administrative privileges. The vendor advisory and the HackerOne CNA record describe the same defect from different angles: cPanel calls it a privilege escalation, while the CNA classifies it as CWE-89, SQL injection. The advisory and CVE record do not identify the injected input, the affected SQL mode or the exact payload, nor do they say whether Team User sub-accounts qualify under the advisory’s definition of an authenticated account holder.
According to cPanel, affected products include all supported versions of cPanel & WHM and WP Squared. The company shipped fixes in these builds: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. cPanel provides an update command for administrators: /usr/local/cpanel/scripts/upcp --force. Where immediate patching is impractical, cPanel says administrators can temporarily revoke the MySQL feature from cPanel users; that leaves existing databases running but prevents users from adding or removing databases.
How the bug works: a database-renaming misstep
The failure sits in cPanel’s database-renaming process. The HackerOne CNA record says SQL mode is not preserved when a database is renamed, causing SQL to execute in root context. cPanel’s documentation describes the rename as a multi-step operation: create a replacement database, move the original data, recreate grants and stored code, and then remove the old database and its grants. CVE-2026-58048 bypasses the intended database-level privilege limits — those that normally do not require SUPER access or allow global modifications — by causing SQL to run in the database administrative context. cPanel warns that, depending on the operating system and database engine configuration, “this may extend to operating-system-level compromise.”
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Two other fixes in the same cPanel release: cpsrvd request-smuggling and Exim flaws
The targeted security release also closes two additional paths across account boundaries. CVE-2026-58047 (CVSS 4.0 score: 5.6) is an HTTP request-smuggling issue in cpsrvd, the daemon that serves cPanel and WHM interfaces. Under limited conditions, an unauthenticated remote attacker may manipulate responses delivered to other users on the same server; the CNA record says credentials could leak as a result. cPanel’s workaround for delayed patching is to disable backend connection reuse by setting cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restarting cpsrvd. cPanel warns this forces a new TCP and TLS connection for each request on ports 2083, 2087 and 2096, increasing latency and CPU use on busy servers. cPanel credits Vincent55 Yang with reporting both CVE-2026-58048 and CVE-2026-58047.
The third advisory covers GCVE-25-2026-07-45-3 in Exim: a local user’s .forward file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. Under cPanel’s default configuration, that expansion and execution occur as the cPanel user, which the company says may allow privilege escalation from Team User sub-accounts. Exim’s advisory specifies conditions for exploitation — a redirect router providing .forward handling, an accessible pipe transport, force_command enabled on that transport and execution as a privileged user — and says Exim 4.99.5 removes the vulnerable expansion. Exim 4.99.5 also fixes GCVE-25-2026-07-45-1, a High-severity local directory traversal through queue-name command-line arguments; Exim says that flaw can access files outside the spool area and be used for privilege escalation.
Administrator mitigations, version confusion, and CISA’s snapshot
Administrators face practical choices. Patch in-place to one of the listed builds, run /usr/local/cpanel/scripts/upcp --force, or revoke the MySQL feature for users until updates are applied. For the cpsrvd issue, setting cpsrvd_keepalives_disabled=1 and restarting cpsrvd is an available workaround at the cost of higher latency and CPU under load. cPanel’s advisories do not completely agree on which builds include which fixes: the database advisory lists build 11.118.0.71 among the patched releases, while the request-smuggling and Exim advisories, published in the same release, leave the 11.118 branch off their lists entirely. cPanel advises anyone on that branch to check the installed point release against the database advisory rather than trusting the shorter lists.
On August 4, CISA’s enrichment recorded “Exploitation: none,” assessed the flaw as non-automatable, and rated its technical impact as total — a snapshot the agency notes covers that moment in time and “says nothing about the days since.”
What this means for hosting customers, administrators, and technologists
- Hosting customers and site owners: If you hold a cPanel account on a shared box, the advisory raises immediate risk; account holders with MySQL/MariaDB access could, in certain environments, run SQL with administrative authority and — depending on OS and database configuration — potentially reach operating-system-level compromise.
- Hosting providers and administrators: You must reconcile cPanel’s build lists, apply the fixed builds listed for CVE-2026-58048 or follow the vendor’s update command, and consider revoking MySQL access or applying the cpsrvd workaround while accepting performance trade-offs.
- Technologists and security teams: The defect’s origin in the rename flow and the CNA’s SQL-injection classification underline that privilege boundaries can fail in maintenance code paths; inventory database-accessing accounts and monitor for unusual grant or rename operations.
cPanel has issued patches and specific mitigations; CISA’s snapshot registered no known exploitation at the time of its August 4 enrichment, but the company’s own description — and the CNA’s differing classification — leave clear that administrators must act deliberately: validate which point release is installed, apply the fixes, and use the stated workarounds when immediate update is infeasible.
https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html
