New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

Swati KhandelwalAug 04, 2026Vulnerability / Database Security

cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database’s root context, crossing the privilege boundary between a cPanel account and the server’s administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries.

The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects all supported versions of cPanel & WHM, along with WP Squared. Reaching it requires a valid cPanel account and access to the MySQL/MariaDB feature. From there, the vendor says the account holder could execute arbitrary database commands with full administrative privileges.

Depending on the operating system and database engine configuration, “this may extend to operating-system-level compromise.”

cPanel patched CVE-2026-58048 in these builds:

11.110.0.137
11.118.0.71
11.126.0.78
11.134.0.48
11.136.0.32
138.1.6 for WP Squared

Servers that cannot update immediately can temporarily revoke the MySQL feature from cPanel users. That leaves existing databases running but prevents users from adding or removing databases. Administrators can update from WHM or use the command documented by cPanel:

/usr/local/cpanel/scripts/upcp --force

CISA’s August 4 enrichment recorded “Exploitation: none,” assessed the flaw as non-automatable, and rated its technical impact as total. That is a snapshot, and it says nothing about the days since.

Under normal operation, cPanel supports database-level privileges that do not require SUPER access or allow global modifications. CVE-2026-58048 bypasses those limits by causing SQL to run in the database administrative context.

The failure sits in cPanel’s database-renaming process. The HackerOne CNA record says SQL mode is not preserved when a database is renamed, causing SQL to execute in root context. According to the company’s database documentation, the system creates a replacement database, moves the original data, recreates grants and stored code, and then removes the old database and its grants.

The vendor advisory titles the issue a privilege escalation and does not use the words SQL injection. The CNA classifies the same defect as CWE-89, SQL injection. The two records describe one bug from different angles. The advisory and CVE record do not identify the injected input, the affected SQL mode or the exact payload. Nor does it say whether Team User sub-accounts, the role-limited logins an account owner can create, meet its description of an authenticated account holder if they hold database access.

A Critical rating is a severity measure. It does not say how many servers have somebody in a position to use the flaw, and here that population is set by who holds accounts on the box: a server whose accounts all belong to one company is a different proposition from one selling accounts to strangers. The line is not clean, since accounts can be phished or resold. And it narrows nothing about consequence, which CISA rated total.

Two more in the same build

CVE-2026-58047 (CVSS 4.0 score: 5.6) is an HTTP request-smuggling issue in cpsrvd, the daemon that serves the cPanel and WHM interfaces. Under limited conditions, an unauthenticated remote attacker may manipulate responses delivered to other users on the same server. The CNA record says credentials could leak as a result.

Where patching has to wait, the workaround is to disable backend connection reuse by setting cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restarting cpsrvd. cPanel says the workaround forces a new TCP and TLS connection for each request on ports 2083, 2087 and 2096, increasing latency and CPU use on busy servers. cPanel credits Vincent55 Yang with reporting both CVEs.

The third cPanel advisory covers GCVE-25-2026-07-45-3 in Exim. A local user’s .forward file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. Under cPanel’s default configuration, the expansion and execution occur as the cPanel user, which the company says may allow privilege escalation from Team User sub-accounts.

Exim’s advisory says exploitation requires a redirect router providing .forward handling, an accessible pipe transport, force_command enabled on that transport and execution as a privileged user. Exim 4.99.5 removes the vulnerable expansion.

Exim 4.99.5 also fixes GCVE-25-2026-07-45-1, a High-severity local directory traversal through queue-name command-line arguments. Exim says the flaw can access files outside the spool area and be used for privilege escalation.

cPanel’s own advisories disagree on which builds carry the fix. The database advisory lists build 11.118.0.71 among the patched releases; the request-smuggling and Exim advisories, published in the same release, leave the 11.118 branch off their lists entirely. Anyone on that branch should check the installed point release against the database advisory rather than trusting the shorter lists.

Neither Exim advisory names a researcher. Each credits “the unnamed and uncredited authors whose works were ingested as the training corpus.”

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts