Runtime Rebel has received intelligence regarding a critical privilege escalation vulnerability, CVE-2026-58048, affecting cPanel & WHM and WP Squared. This flaw, rated with a CVSS 4.0 score of 9.4, allows an authenticated hosting customer with MySQL/MariaDB access to execute arbitrary SQL commands within the database’s root context. This effectively bypasses intended privilege boundaries, potentially leading to full administrative control over the database and, depending on server configuration, even operating-system-level compromise, as detailed by The Hacker News.
Understanding CVE-2026-58048: cPanel & WHM SQL Privilege Escalation
The core of CVE-2026-58048 lies within cPanel’s database-renaming process. According to the source, the vulnerability (classified as CWE-89, SQL injection, by HackerOne) allows SQL mode to be improperly preserved during a database rename operation. This misconfiguration leads to SQL execution in the database administrative context, rather than the user’s restricted context. This means that a standard cPanel account holder, provided they have access to the MySQL/MariaDB feature, can elevate their database privileges to a root equivalent. The advisory titles the issue a privilege escalation, highlighting the severity of an authenticated user gaining such extensive control.
While CISA’s August 4 enrichment indicated no exploitation at the time of their snapshot and assessed the flaw as non-automatable, the critical nature of the vulnerability necessitates immediate attention. The potential for an authenticated user to achieve arbitrary database command execution with full administrative privileges poses a significant risk to the integrity and confidentiality of data hosted on affected servers. Furthermore, the possibility of this extending to operating-system-level compromise underscores the need for swift action, particularly for shared hosting environments where accounts may belong to different, untrusted entities or could be compromised through phishing.
Other Significant Vulnerabilities
This security release from cPanel addresses two additional vulnerabilities:
- CVE-2026-58047: This is an HTTP request-smuggling issue within
cpsrvd, the daemon responsible for serving cPanel and WHM interfaces. Under specific, limited conditions, an unauthenticated remote attacker could manipulate responses delivered to other users on the same server, potentially leading to credential leakage. This vulnerability has a CVSS 4.0 score of 5.6. - Exim Vulnerabilities (GCVE-25-2026-07-45-3 and GCVE-25-2026-07-45-1): Two issues in Exim are also patched. GCVE-25-2026-07-45-3 involves unsafe string expansion in the redirect router via a local user’s
.forwardfile under certain pipe-transport configurations. This could allow privilege escalation from Team User sub-accounts. GCVE-25-2026-07-45-1 is a high-severity local directory traversal flaw, enabling access to files outside the spool area for privilege escalation.
Actionable Recommendations and Mitigations
how to patch cPanel arbitrary database command execution and mitigate these critical flaws requires immediate action from administrators. Timely patching is the most effective defense.
- Immediate Updates: The primary recommendation is to update cPanel & WHM to the latest security release as soon as possible. Specifically for CVE-2026-58048, build 11.118.0.71 is among the patched releases. Administrators can perform updates directly from WHM or via the command line as documented by cPanel.
- Temporary Mitigation for CVE-2026-58048: For servers that cannot update immediately, a temporary workaround involves revoking the MySQL feature from cPanel users. This action prevents users from adding or removing databases but allows existing databases to continue functioning. This significantly reduces the attack surface for the SQL privilege escalation vulnerability.
- Mitigating cPanel cpsrvd HTTP request smuggling: For CVE-2026-58047, if patching must be delayed, disable backend connection reuse by setting
cpsrvd_keepalives_disabled=1in/var/cpanel/cpanel.configand restarting thecpsrvddaemon. Be aware that this workaround may increase latency and CPU usage on busy servers. - Exim Updates: Ensure Exim is updated to version 4.99.5 or later to address the unsafe string expansion and local directory traversal vulnerabilities. Administrators should verify the specific build against cPanel’s advisories, as some listings have shown discrepancies.
- Review Account Permissions: Regularly audit and review the permissions of cPanel accounts, especially those with access to database features, to ensure adherence to the principle of least privilege.
Defenders should prioritize these updates to protect against potential data breaches and system compromises, especially given the broad deployment of cPanel & WHM in hosting environments.
Related: Hardening Automatic Tank Gauge Systems Against Cyber Threats, CVE-2026-54420: LiteSpeed cPanel Plugin Flaw Under Active Exploit