cPanel has released security updates to address a cPanel critical flaw that could allow an authenticated hosting customer to execute SQL in a database administrative context. In plain terms: under specific conditions, an attacker with a valid cPanel account and access to the database interface could bypass privilege boundaries and gain database root-level power.
The issue is tracked as CVE-2026-58048 with a CVSS 4.0 score of 9.4. cPanel states it affects all supported versions of cPanel & WHM, as well as WP Squared. While cPanel has already published fixed builds, administrators who cannot patch immediately may need to apply temporary mitigation steps.
What the cPanel critical flaw could let attackers do
According to the advisory, reaching the weakness requires an authenticated cPanel user who can access the MySQL/MariaDB feature. From there, the company says the account holder could run arbitrary database commands with full administrative privileges.
The advisory also notes that the practical outcome can vary depending on the operating system and how the database engine is configured. In some environments, cPanel warns this may extend to operating-system-level compromise.
CVE-2026-58048 details: bypassing privilege boundaries
Under normal operation, cPanel supports database-level privilege models that avoid requiring broad SUPER access or enabling global modifications. The cPanel critical flaw changes that behavior by causing SQL to execute inside the database’s administrative root context, effectively crossing the boundary between a cPanel account identity and the server’s administrative database identity.
The failure is tied to cPanel’s database renaming workflow. The underlying issue, as described in the CNA record associated with cPanel, involves SQL mode not being preserved when a database is renamed—leading to SQL executing under root context rather than the expected restricted context.
cPanel’s documentation explains the rename process at a high level: it creates a replacement database, migrates the original data, recreates grants and stored code, and then removes the old database and its grants. The cPanel critical flaw appears within that sequence.
Why patch urgency is high
cPanel lists this issue as a privilege escalation and assigns a Critical severity. The update guidance also reflects that the technical impact is considered total by CISA’s enrichment snapshot—however, that snapshot alone does not tell defenders how long systems may have been exposed in the real world.
Another practical factor is exposure: the likelihood of exploitation depends on who holds accounts on the server. A host serving a single organization’s customers is different from one selling accounts broadly to unknown parties. Even in the “broad exposure” model, accounts can be phished or resold, which complicates assumptions about who might actually be in a position to attempt database abuse.
Fixed cPanel builds for CVE-2026-58048
cPanel patched CVE-2026-58048 in specific builds. The vendor lists the following corrected versions:
- 11.110.0.137
- 11.118.0.71
- 11.126.0.78
- 11.134.0.48
- 11.136.0.32
- 138.1.6 for WP Squared
That list matters for administrators because cPanel also publishes multiple advisories in the same security release—some of which may not mirror the database advisory’s patched build list.
Temporary mitigation if you can’t patch right away
If immediate updates are not possible, cPanel provides a temporary workaround: administrators can revoke the MySQL feature from cPanel users. That approach is intended to keep existing databases running while preventing users from adding or removing databases.
cPanel also documents an update path using the updater script: /usr/local/cpanel/scripts/upcp –force. Where patching must wait, removing access to the relevant database capability can reduce the chance that the privilege-escalation path is reachable.
Is this the same as SQL injection?
One reason the issue description can feel confusing is that different records describe the same underlying bug in different security categories. The advisory does not use the phrase “SQL injection,” while the CNA record classifies it as CWE-89, which is commonly associated with SQL injection.
In the material cPanel cites, there is no specific detail about the injected input, the SQL mode, or the exact payload. Additionally, the documents do not clarify whether Team User sub-accounts (role-limited logins created by the account owner) meet the same “authenticated account holder” description when database access is present.
Two additional cPanel-related security issues
Alongside the database problem, cPanel’s release includes at least two more advisories that administrators should review.
cpsrvd request smuggling (CVE-2026-58047)
The second item, CVE-2026-58047 with a CVSS 4.0 score of 5.6, involves HTTP request smuggling in cpsrvd, the daemon that serves the cPanel and WHM interfaces.
Under limited conditions, an unauthenticated remote attacker may manipulate responses delivered to other users on the same server. The CNA record suggests that credential leakage could result from this behavior.
For environments that must defer patching, cPanel recommends a mitigation: disable backend connection reuse by setting cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config, then restart cpsrvd. cPanel notes this can increase latency and CPU use because each request on ports 2083, 2087, and 2096 requires a fresh TCP and TLS connection.
Exim redirect router and .forward expansion
The third advisory relates to Exim and a weakness involving users’ .forward files. Under certain redirect router and pipe-transport configurations, unsafe string expansion could lead to privilege escalation paths.
cPanel’s advisory indicates that under the default setup, the expansion and execution occur as the cPanel user. That, in turn, may allow privilege escalation from Team User sub-accounts.
Exim’s advisory specifies that exploitation depends on a redirect router with .forward handling, an accessible pipe transport, force_command enabled for that transport, and execution as a privileged user. Exim 4.99.5 removes the vulnerable expansion.
Exim 4.99.5 also fixes a separate high-severity local issue (GCVE-25-2026-07-45-1) involving a directory traversal through queue-name command-line arguments. Exim notes it can access files outside the spool area and potentially support privilege escalation.
Be careful with build lists across advisories
One operational detail administrators should not overlook: cPanel’s advisories may not list the same builds as “patched” for every component. For example, the database advisory includes build 11.118.0.71 as fixed for CVE-2026-58048, while the request-smuggling and Exim advisories published in the same release do not list the same 11.118 branch entries.
That means teams should verify the installed point release against the database advisory when focusing on CVE-2026-58048, rather than assuming every advisory shares identical “patched build” ranges.
Action checklist for administrators
If you manage servers running cPanel & WHM, start with the items most likely to reduce risk quickly:
- Update to a build that includes the fixes for CVE-2026-58048.
- If you cannot patch immediately, revoke MySQL/MariaDB feature access in cPanel until updates are applied.
- Review whether your installed build versions match the patched releases for the relevant advisories (database, cpsrvd, and Exim).
- If applicable, consider the cpsrvd_keepalives_disabled=1 workaround and understand the performance tradeoffs.
- For Exim environments, ensure you are on a version that removes the vulnerable redirect router/.forward expansion behavior.
Bottom line
The released fixes target a cPanel critical flaw that can enable authenticated users to run SQL with database administrative root privileges (CVE-2026-58048). Because cPanel also published related updates for cpsrvd and Exim, administrators should treat this as more than a single patch event—plan a quick validation of installed builds and apply the recommended mitigations where necessary.
Source: https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html
