A critical cPanel flaw (CVE-2026-58048) lets authenticated users execute SQL as root. Users should update to fixed versions immediately.
If you run a shared hosting box, this one’s worth reading before your morning coffee gets cold. cPanel just patched a flaw, tracked as CVE-2026-58048 (CVSS score of 9.4), that let an ordinary authenticated hosting customer, someone with nothing more than a standard account, execute SQL commands inside the database’s root context.
“An authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges.” reads the advisory. “Depending on the operating system and database engine configuration, this may extend to operating-system-level compromise.”
The vulnerability impacts every supported version of cPanel & WHM plus WP Squared. To trigger it, you need a valid cPanel account with access to the MySQL/MariaDB feature, nothing exotic. From there, an attacker could run arbitrary database commands with full administrative privileges, and depending on the OS and database setup, that can climb all the way to compromising the operating system itself.
The root cause sits in something almost mundane: renaming a database. When cPanel renames one, it builds a replacement database, moves the data over, recreates the grants and stored code, then deletes the original along with its permissions. Somewhere in that process, SQL mode doesn’t get preserved correctly, and that’s the crack that lets commands execute with root-level authority instead of the account’s normal limited privileges.
Researcher Vincent55 Yang reported the vulnerability.
There’s a small classification mismatch worth flagging here. cPanel’s own advisory calls this a privilege escalation and never uses the words “SQL injection.” The CNA record, on the other hand, files it under CWE-89, which is literally the SQL injection category. Both descriptions point at the same bug, just from different angles, and neither one spells out the exact payload or which SQL mode gets broken.
One thing the advisory doesn’t clarify: whether Team User sub-accounts, the limited-permission logins an account owner can hand out, count as an “authenticated account holder” if they happen to have database access. That’s not a minor detail on a server hosting multiple client sites through delegated logins. Worth checking directly with cPanel support if your setup relies on those sub-accounts.
On August 4, US CISA listed exploitation status as none observed and calls the flaw non-automatable, while still rating the technical impact as total. That’s a snapshot, not a guarantee about tomorrow. A “Critical” severity score tells you how bad it gets if abused, not how many people currently have the access needed to try it, and that population depends entirely on who holds accounts on a given box.
The following builds address the issues: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. Anyone who can’t patch immediately can pull the MySQL feature from cPanel users as a stopgap, which keeps existing databases running while blocking new ones from being created or removed.
“Servers that cannot immediately upgrade can temporarily revoke the “MySQL” feature from cPanel users. This will not disable existing databases but just prevent adding/removing. To do so, you can follow the steps here:
How to edit a feature list” continues the advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, CVE-2026-58048)
Entrar
