cPanel patches critical database-root privilege escalation
cPanel has fixed CVE-2026-58048, a critical privilege-escalation flaw that allowed an authenticated hosting customer to execute arbitrary SQL in the database root context. The vulnerability carries a CVSS 4.0 score of 9.4 and affects all supported versions of cPanel & WHM, as well as WP Squared.
Exploitation requires a valid cPanel account with access to the MySQL or MariaDB feature. Depending on the operating system and database configuration, cPanel said the result may extend to operating-system-level compromise.
How the privilege boundary failed
Normal cPanel operation grants database-level privileges without SUPER access or permission for global changes. CVE-2026-58048 bypassed that boundary during database renaming: the HackerOne CNA record says SQL mode was not preserved, causing SQL to execute in the administrative context.
The rename workflow creates a replacement database, moves the original data, recreates grants and stored code, then removes the old database and its grants. cPanel describes the defect as privilege escalation, while the CNA classifies it as CWE-89, SQL injection. Neither record identifies the injected input, affected SQL mode, exact payload, or whether database-enabled Team User sub-accounts qualify as authenticated account holders.
CISA recorded no exploitation as of August 4, assessed the flaw as non-automatable and rated its technical impact as total. Exposure still depends on who controls accounts on each server, including whether accounts belong to one organization or are sold to unrelated customers. That account trust boundary reflects the broader risk behind trusted access crossing security boundaries, where legitimate access can become a route past expected controls.
Patched builds and interim action
The fixes are available in cPanel & WHM builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48 and 11.136.0.32, plus WP Squared 138.1.6. Administrators can update through WHM or run /usr/local/cpanel/scripts/upcp --force.
If an immediate update is impossible, cPanel recommends temporarily revoking the MySQL feature from users. Existing databases continue running, but users cannot add or remove databases.
Two additional boundary flaws
The same security release addresses CVE-2026-58047, a 5.6-rated HTTP request-smuggling flaw in cpsrvd. Under limited conditions, an unauthenticated remote attacker could manipulate responses sent to other users on the server, potentially exposing credentials. The temporary mitigation disables backend connection reuse, but forces a fresh TCP and TLS connection for each request on ports 2083, 2087 and 2096, increasing latency and CPU demand.
A third advisory covers GCVE-25-2026-07-45-3 in Exim. Under certain pipe-transport configurations, a local user's .forward file can trigger unsafe string expansion in the redirect router. Exim 4.99.5 removes that expansion and also fixes GCVE-25-2026-07-45-1, a high-severity local directory traversal that can reach files outside the spool area and support privilege escalation.
Because the advisories disagree on whether the 11.118 branch carries every fix, organizations using that branch should verify the exact installed point release against the database advisory. The practical priority is to patch, restrict database access until that is possible, and review which customers or sub-accounts can reach privileged server features.