cPanel has patched a critical privilege-escalation flaw that allows an authenticated hosting customer — anyone with a valid cPanel account and database access — to execute arbitrary SQL commands in the server’s administrative root context. Under normal operation, cPanel accounts are restricted to database-level privileges that cannot touch server-wide settings. CVE-2026-58048 (CVSS 4.0 score: 9.4) breaks that boundary through a bug in cPanel’s database-rename process: when a database is renamed, SQL mode is not preserved, causing subsequent SQL to execute as the database administrative identity rather than the limited account identity. cPanel’s advisory calls it a privilege escalation; the HackerOne CNA independently classified the same flaw as SQL injection under CWE-89. The practical upshot is the same: an attacker with any kind of hosting account on a vulnerable server can escalate to the database root and, depending on the server configuration, potentially to the operating system itself. All supported versions of cPanel & WHM and WP Squared are affected.
The same security release patches two additional issues: CVE-2026-58047 (CVSS 5.6), an HTTP request-smuggling flaw in cpsrvd, the daemon behind the cPanel and WHM web interfaces, which under limited conditions could allow an unauthenticated attacker to manipulate responses to other users on the same server, potentially leaking credentials; and a local Exim vulnerability (GCVE-25-2026-07-45-3) that may allow privilege escalation from Team User sub-accounts through unsafe .forward file string expansion. CISA’s initial assessment of CVE-2026-58048 noted no confirmed exploitation yet, but rated its technical impact as total.
How to check if you’re affected
Affected versions include all cPanel & WHM installations prior to the patched build (11.118.0.71 for the 11.118 branch). If you run a cPanel server — or your hosting provider does — update immediately using WHM’s built-in updater or by running:
/usr/local/cpanel/scripts/upcp --force
If an immediate update is not possible, temporarily revoking the MySQL/MariaDB feature from cPanel accounts will block exploitation of CVE-2026-58048 while leaving existing databases intact. For CVE-2026-58047, the workaround is setting cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restarting cpsrvd, which increases per-request latency but closes the smuggling path.
Sources
- New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root — The Hacker News
- cPanel Security Advisories — support.cpanel.net