cPanel CVE-2026-58048
cPanel has released a targeted security update addressing a vulnerability that could let an authenticated hosting customer execute SQL in the database's root context.
The flaw crosses the privilege boundary between a cPanel account and the server's administrative database identity. If exploited, it could lead to full database compromise and, depending on configuration, operating-system-level compromise.
The database bug is tracked as CVE-2026-58048 and carries a CVSS 4.0 score of 9.4. It affects all supported versions of cPanel & WHM, along with WP Squared. Reaching it requires a valid cPanel account and access to the MySQL or MariaDB feature. From there, the account holder could execute arbitrary database commands with full administrative privileges.
cPanel also patched two other vulnerabilities in the same security release. Let me walk through what is affected, what has been fixed, and what administrators need to do.
The cPanel CVE-2026-58048 Database Flaw
The cPanel CVE-2026-58048 vulnerability is a privilege escalation issue that allows SQL to run in the database administrative context. cPanel usually provides permissions for databases which do not need super access or any changes globally. This loophole works around such constraints.
The vulnerability is present in the cPanel database renaming functionality. As per the HackerOne CNA report, the SQL mode does not remain consistent during database renaming, making SQL run with root privilege.
The system creates a replacement database, moves the original data, recreates grants and stored code, and then removes the old database and its grants. Something in this process allows the privilege boundary to be crossed.
The vendor advisory titles the issue a privilege escalation and does not use the words SQL injection. The CNA classifies the same defect as CWE-89, SQL injection. The two records describe one bug from different angles. The advisory and CVE record do not identify the injected input, the affected SQL mode, or the exact payload.
What Is the Impact of CVE-2026-58048?
The impact of the cPanel CVE-2026-58048 vulnerability depends on the operating system and database engine configuration. cPanel warns that depending on these factors, "this may extend to operating-system-level compromise."
At minimum, an attacker with a valid cPanel account could execute arbitrary SQL commands with full administrative privileges. This means they could read, modify, or delete any data in any database on the server. They could also create new administrative users, change database configurations, and potentially compromise other accounts on the same server.
CISA's August 4 enrichment recorded exploitation as "none" and assessed the flaw as non-automatable. It rated the technical impact as total. That is a snapshot, and it says nothing about the days since. The cPanel CVE-2026-58048 vulnerability is serious and requires attention.
Which Versions Are Affected by CVE-2026-58048?
The cPanel CVE-2026-58048 vulnerability affects all supported versions of cPanel & WHM, along with WP Squared. cPanel has patched the flaw in the following builds:
- 11.110.0.137
- 11.118.0.71
- 11.126.0.78
- 11.134.0.48
- 11.136.0.32
- 138.1.6 for WP Squared
If you are running any version prior to these builds, you are vulnerable to the cPanel CVE-2026-58048 vulnerability and need to update.
What If You Cannot Patch Immediately?
For servers that cannot update immediately, cPanel recommends a temporary workaround. Administrators can revoke the MySQL feature from cPanel users. This leaves existing databases running but prevents users from adding or removing databases.
This is a mitigation, not a fix. It reduces the attack surface while you plan your update. The cPanel CVE-2026-58048 vulnerability is too serious to leave unpatched for long.
The cpsrvd Request Smuggling Flaw
The same security release also addresses CVE-2026-58047, an HTTP request-smuggling issue in cpsrvd. This is the daemon that serves the cPanel and WHM interfaces.
Under limited conditions, an unauthenticated remote attacker may manipulate responses delivered to other users on the same server. The CNA record says credentials could leak as a result.
The vulnerability carries a CVSS 4.0 score of 5.6. It is not as serious as the database issue, but still worrisome. Credentials leak can lead to attacks on compromised accounts.
For those servers that cannot install the patches at once, the cPanel provides a temporary solution. The parameter to prevent backend connection reuse should be set to cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config.
This forces a new TCP and TLS connection for each request on ports 2083, 2087, and 2096. However, cPanel warns this increases latency and CPU use on busy servers.
cPanel credited Vincent55 Yang with reporting both CVE-2026-58048 and CVE-2026-58047.
The Exim Vulnerabilities
The third cPanel advisory covers vulnerabilities in Exim. A local user's .forward file can trigger unsafe string expansion in the redirect router under certain pipe-transport configurations. Under cPanel's default configuration, the expansion and execution occur as the cPanel user, which the company says may allow privilege escalation from Team User sub-accounts.
Exim's advisory says exploitation requires several conditions: a redirect router providing .forward handling, an accessible pipe transport, force_command enabled on that transport, and execution as a privileged user. Exim 4.99.5 removes the vulnerable expansion.
Exim 4.99.5 also fixes a separate High-severity local directory traversal issue. The flaw can access files outside the spool area and be used for privilege escalation.
Neither Exim advisory names a researcher. Each credits "the unnamed and uncredited authors whose works were ingested as the training corpus."
The Build List Discrepancy
There is a notable discrepancy in cPanel's advisories. The database advisory lists build 11.118.0.71 among the patched releases. However, the request-smuggling and Exim advisories, published in the same release, leave the 11.118 branch off their lists entirely.
Anyone on that branch should check the installed point release against the database advisory rather than trusting the shorter lists. The cPanel CVE-2026-58048 vulnerability is fixed in 11.118.0.71, regardless of what the other advisories say.
The Risk Assessment Question
A Critical rating is a severity measure. It does not tell you how many servers have someone in a position to use the cPanel CVE-2026-58048 vulnerability. The risk depends on who holds accounts on the box. A server whose accounts all belong to one company is a different proposition from one selling accounts to strangers.
The line is not clean. Accounts can be phished or resold. A hosting provider selling accounts to unknown customers faces a much higher risk than an organization using cPanel internally.
The cPanel CVE-2026-58048 vulnerability also raises questions about Team User sub-accounts. The advisory does not say whether Team User sub-accounts, the role-limited logins an account owner can create, meet its description of an authenticated account holder if they hold database access. This ambiguity makes risk assessment more difficult.
How to Update
Administrators can update from WHM or use the command documented by cPanel:
/usr/local/cpanel/scripts/upcp --force
This command forces an immediate update to the latest version. This would be the recommended method of solving the cPanel CVE-2026-58048 vulnerability issue.
How Hosting Companies Are Affected by the Vulnerability
The cPanel CVE-2026-58048 vulnerability affects hosting companies significantly. If you sell cPanel accounts to your clients, then you must realize that there is a risk involved. A malicious customer with a valid account could potentially compromise the entire server.
Hosting providers should prioritize this update. The CVE-2026-58048 vulnerability in cPanel is a cross-account issue, in which an exploitation in one account can affect all customers within the same server.
Wrapping It Up
The cPanel CVE-2026-58048 vulnerability is a critical SQL injection flaw that allows authenticated users to execute SQL with root privileges. It affects all supported versions of cPanel & WHM. cPanel has released patches for all affected branches.
The same security release addresses a request-smuggling flaw in cpsrvd and Exim vulnerabilities. Administrators should update to the latest builds immediately.
If you cannot patch, revoke the MySQL feature from cPanel users as a temporary workaround. But do not delay the update. The cPanel CVE-2026-58048 vulnerability is too serious to leave unpatched.
FAQ Section
What is the cPanel CVE-2026-58048 vulnerability?
This is a very important SQL injection vulnerability in which an authenticated cPanel user can run SQL commands with complete administrative privileges in the database root context. This can lead to database compromise and potentially operating-system-level compromise.
Which cPanel versions are affected?
All supported versions of cPanel & WHM and WP Squared are affected. The patched versions available are 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared.
What can I do to resolve the cPanel vulnerability CVE-2026-58048?
Use WHM to update, or use the command /usr/local/cpanel/scripts/upcp --force. This will update to the newest patched version.
What is the temporary workaround?
Administrators can revoke the MySQL feature from cPanel users. This prevents them from adding or removing databases but leaves existing databases running.
What other vulnerabilities were patched in this release?
The same release also addressed CVE-2026-58047, an HTTP request-smuggling flaw in cpsrvd, and vulnerabilities in Exim including .forward file privilege escalation and directory traversal.
