{"id":2194,"date":"2026-08-04T11:56:06","date_gmt":"2026-08-04T11:56:06","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2194"},"modified":"2026-08-04T11:56:06","modified_gmt":"2026-08-04T11:56:06","slug":"new-cpanel-critical-flaw-could-let-hosting-customers-run-sql-as-database-root","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2194","title":{"rendered":"New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Swati Khandelwal<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Aug 04, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Database Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi2LFB09rf16kl1_PinOnHkAY4GiI38_azQ2t-EWYRicFndp5DX-5KSfwVVEJxwEKp07oouBfkFg71MxwilLY_M2i3clk82hs5-Xr-PgDj69JeYzTsPjp_8sdNZIminQFonHRq2GqWDXJuwGqpT4Na485_pILlvMSlBdSMqWYWqTHDrUC_9OdOW-kCdSeM\/s1700-e365\/cpanel.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database&#8217;s root context, crossing the privilege boundary between a cPanel account and the server&#8217;s administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries.<\/p>\n<p>The database bug is tracked as <b>CVE-2026-58048<\/b> (CVSS 4.0 score: 9.4) and affects all supported versions of cPanel &amp; WHM, along with WP Squared. Reaching it requires a valid cPanel account and access to the MySQL\/MariaDB feature. From there, the vendor says the account holder could execute arbitrary database commands with full administrative privileges.<\/p>\n<p>Depending on the operating system and database engine configuration, \u201cthis may extend to operating-system-level compromise.\u201d<\/p>\n<p>cPanel patched <code>CVE-2026-58048<\/code> in these builds:<\/p>\n<ul>\n<li>11.110.0.137<\/li>\n<li>11.118.0.71<\/li>\n<li>11.126.0.78<\/li>\n<li>11.134.0.48<\/li>\n<li>11.136.0.32<\/li>\n<li>138.1.6 for WP Squared<\/li>\n<\/ul>\n<p>Servers that cannot update immediately can temporarily revoke the MySQL feature from cPanel users. That leaves existing databases running but prevents users from adding or removing databases. Administrators can update from WHM or use the <a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/1500004959421-How-do-I-update-cPanel-WHM\">command documented by cPanel<\/a>:<\/p>\n<pre><code>\/usr\/local\/cpanel\/scripts\/upcp --force<\/code><\/pre>\n<p><a href=\"https:\/\/github.com\/cisagov\/vulnrichment\/blob\/develop\/2026\/58xxx\/CVE-2026-58048.json\">CISA&#8217;s August 4 enrichment<\/a> recorded \u201cExploitation: none,\u201d assessed the flaw as non-automatable, and rated its technical impact as total. That is a snapshot, and it says nothing about the days since.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlocker-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh5OTk93vfDmhLLtqoMsx4w59kseqsUysQ92SKB-S2vDoKsMmMfCCkx8AbG5MFzFvZ7rkzKd5LtgOCxlRF2FJ-0FArsVhpOnTMX31VBi9TX-z1Pgv9oSvXiT23KyDlxtVqI0dPRdMIuWc9fbNWgQF8CisKtMme0LpNr79b4wRaeDRxCjfGB8GsxfXa8Ltro\/s728-e100\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Under normal operation, cPanel <a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/360051227374-What-MySQL-privileges-are-supported-by-cPanel\">supports database-level privileges<\/a> that do not require <code>SUPER<\/code> access or allow global modifications. <code>CVE-2026-58048<\/code> bypasses those limits by causing SQL to run in the database administrative context.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>The failure sits in cPanel&#8217;s database-renaming process. The <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-58048\">HackerOne CNA record<\/a> says SQL mode is not preserved when a database is renamed, causing SQL to execute in root context. According to the company&#8217;s <a href=\"https:\/\/docs.cpanel.net\/cpanel\/databases\/mysql-databases\/\">database documentation<\/a>, the system creates a replacement database, moves the original data, recreates grants and stored code, and then removes the old database and its grants.<\/p>\n<p>The <a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation\">vendor advisory<\/a> titles the issue a privilege escalation and does not use the words SQL injection. The CNA classifies the same defect as CWE-89, SQL injection. The two records describe one bug from different angles. The advisory and CVE record do not identify the injected input, the affected SQL mode or the exact payload. Nor does it say whether Team User sub-accounts, the role-limited logins an account owner can create, meet its description of an authenticated account holder if they hold database access.<\/p>\n<p>A Critical rating is a severity measure. It does not say how many servers have somebody in a position to use the flaw, and here that population is set by who holds accounts on the box: a server whose accounts all belong to one company is a different proposition from one selling accounts to strangers. The line is not clean, since accounts can be phished or resold. And it narrows nothing about consequence, which CISA rated total.<\/p>\n<h2>Two more in the same build<\/h2>\n<p><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling\"><code>CVE-2026-58047<\/code><\/a> (CVSS 4.0 score: 5.6) is an HTTP request-smuggling issue in <code>cpsrvd<\/code>, the daemon that serves the cPanel and WHM interfaces. Under limited conditions, an unauthenticated remote attacker may manipulate responses delivered to other users on the same server. The <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-58047\">CNA record<\/a> says credentials could leak as a result.<\/p>\n<p>Where patching has to wait, the workaround is to disable backend connection reuse by setting <code>cpsrvd_keepalives_disabled=1<\/code> in <code>\/var\/cpanel\/cpanel.config<\/code> and restarting <code>cpsrvd<\/code>. cPanel says the workaround forces a new TCP and TLS connection for each request on ports 2083, 2087 and 2096, increasing latency and CPU use on busy servers. cPanel credits Vincent55 Yang with reporting both CVEs.<\/p>\n<p>The third cPanel advisory covers <a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/42285884685207-Security-GCVE-25-2026-07-45-3-Exim-forward-Privilege-Escalation\"><code>GCVE-25-2026-07-45-3<\/code><\/a> in Exim. A local user&#8217;s <code>.forward<\/code> file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. Under cPanel&#8217;s default configuration, the expansion and execution occur as the cPanel user, which the company says may allow privilege escalation from Team User sub-accounts.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p><a href=\"https:\/\/www.exim.org\/static\/doc\/security\/EXIM-Security-2026-06-22.3\/EXIM-Security-2026-06-22.3.txt\">Exim&#8217;s advisory<\/a> says exploitation requires a redirect router providing <code>.forward<\/code> handling, an accessible pipe transport, <code>force_command<\/code> enabled on that transport and execution as a privileged user. Exim 4.99.5 removes the vulnerable expansion.<\/p>\n<p>Exim 4.99.5 also fixes <a href=\"https:\/\/www.exim.org\/static\/doc\/security\/EXIM-Security-2026-06-22.1\/EXIM-Security-2026-06-22.1.txt\"><code>GCVE-25-2026-07-45-1<\/code><\/a>, a High-severity local directory traversal through queue-name command-line arguments. Exim says the flaw can access files outside the spool area and be used for privilege escalation.<\/p>\n<p>cPanel&#8217;s own advisories disagree on which builds carry the fix. The database advisory lists build <code>11.118.0.71<\/code> among the patched releases; the request-smuggling and Exim advisories, published in the same release, leave the 11.118 branch off their lists entirely. Anyone on that branch should check the installed point release against the database advisory rather than trusting the shorter lists.<\/p>\n<p>Neither Exim advisory names a researcher. Each credits \u201cthe unnamed and uncredited authors whose works were ingested as the training corpus.\u201d<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Swati Khandelwal\ue802Aug 04, 2026Vulnerability \/ Database Security cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database&#8217;s root context, crossing the privilege boundary between&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2195,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1465,58,2109,2303,70,2869,61,1774,562],"class_list":["post-2194","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-cpanel","tag-critical","tag-customers","tag-database","tag-flaw","tag-hosting","tag-root","tag-run","tag-sql"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2194"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2194\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2195"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}