Full research report

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-58048 is a vendor-confirmed, NVD-corroborated privilege escalation in cPanel's database-rename workflow where failure to restore SQL mode causes subsequent statements to run as the database administrative user rather than the restricted cPanel account. The CVSS 9.4 score reflects network-reachable access, low complexity, low-privilege requirement, no user interaction, and high impact across confidentiality, integrity, and availability at both local and system scope. No public exploit exists as of 5 August 2026, and CISA records no current exploitation — but the vulnerability is within reach of any holder of a cPanel account with database feature access on an unpatched server, a population that includes paying strangers in commercial shared-hosting. The discrepancy between the CNA's CWE-89 classification and cPanel's 'privilege escalation' framing reflects genuine ambiguity about whether the root-context execution is exploitable through a user-controlled rename input (SQL injection) or occurs structurally regardless of input; the vendor has not published sufficient technical detail to resolve this. The bundled CVE-2026-58047 request-smuggling flaw is lower severity but unauthenticated, making it a secondary credential-leakage risk on unpatched servers.

What happened

cPanel released a targeted security update on approximately 4 August 2026 addressing three separate vulnerabilities in its hosting control-panel platform. The most severe, CVE-2026-58048 (CVSS 4.0: 9.4), allows an authenticated cPanel user to execute SQL under the database's administrative identity by exploiting a failure to preserve SQL mode during the database-renaming workflow. The same release addresses HTTP request smuggling in the cpsrvd daemon (CVE-2026-58047, CVSS 5.6) and Exim privilege-escalation and directory-traversal flaws resolved in Exim 4.99.5. Security researcher Vincent55 Yang is credited with responsibly disclosing both CVEs via HackerOne.

Affected scope

All supported versions of cPanel & WHM and WP Squared prior to the specified patched builds. Highest risk applies to shared-hosting and multi-tenant environments where multiple parties — including paying strangers in commercial hosting — hold cPanel accounts with MySQL or MariaDB feature access.

Technical assessment

The root cause sits in cPanel's database-rename workflow, which creates a replacement database, migrates data, recreates grants and stored objects, then removes the old database. SQL mode is not preserved across this sequence, causing subsequent SQL to execute under the database administrative identity rather than the restricted per-account context. cPanel's advisory terms this privilege escalation; HackerOne as CNA records CWE-89 (SQL injection). Both framings describe the same defect from different angles. No injected payload, specific SQL mode, or reproduction steps have been published. If the database engine holds elevated filesystem privileges, CISA's 'total technical impact' rating indicates a potential path to operating-system-level compromise.

Recommended defensive actions

  1. Patch all cPanel & WHM servers to the appropriate fixed build (11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or WP Squared 138.1.6) by running /usr/local/cpanel/scripts/upcp --force from WHM
  2. Revoke the MySQL/MariaDB feature from all cPanel user accounts on servers that cannot be patched immediately; existing databases remain intact but users cannot create or remove databases
  3. Apply the CVE-2026-58047 interim workaround on unpatched servers: set cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restart cpsrvd
  4. Upgrade Exim to 4.99.5 to remediate the bundled GCVE local privilege-escalation and directory-traversal advisories
  5. Enable MySQL/MariaDB audit logging and monitor for anomalous privilege-level SQL operations, unexpected database renames, or unusual stored-object or grant modifications
  6. Review Team User sub-accounts holding database access and treat them as potentially within scope of CVE-2026-58048 until the vendor clarifies their eligibility

Uncertainties and evidence gaps

  • Whether Team User sub-accounts with database access qualify as 'authenticated account holders' under the vendor's description and can exploit CVE-2026-58048 — the advisory does not address this
  • The CISA SSVC enrichment timestamp of 31 July 2026 predates the publicly reported release date of 4 August 2026, suggesting pre-release or private notification; the relationship is not explained in public records
  • The vendor advisory classifies the flaw as privilege escalation while the HackerOne CNA record uses CWE-89 SQL injection; the specific injected input, affected SQL mode, and precise exploitation path are not publicly disclosed
  • The 11.118 branch appears in the database advisory's patched-builds list but is absent from the request-smuggling and Exim advisories published in the same release; administrators on that branch should verify their installed point release against each advisory individually

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessValid cPanel account with MySQL or MariaDB feature enabled — credentials may be held legitimately or obtained through phishing, credential reuse, or account resale in shared-hosting contexts
ComponentcPanel database-renaming subsystem within cPanel & WHM and WP Squared
MechanismSQL mode is not preserved during the database-rename sequence; subsequent SQL operations therefore execute under the database administrative identity rather than the restricted per-account context
ImpactFull database administrative access on the server; potential operating-system-level compromise in configurations where the database engine holds elevated filesystem privileges
DetectionAnomalous database rename events, unexpected SUPER-privilege SQL operations, or unusual stored-object or grant modifications in MySQL/MariaDB audit logs; cPanel access logs showing database management actions from low-trust accounts
MitigationUpdate to a patched cPanel & WHM or WP Squared build via /usr/local/cpanel/scripts/upcp --force; interim: revoke the MySQL/MariaDB feature from cPanel user accounts in WHM
Exploitation status

No active exploitation confirmed; CISA SSVC assessment recorded 'no exploitation currently observed', rated non-automatable with total technical impact; no public proof-of-concept exploit has been identified.

Research process

Investigation began with the THN article, which identified CVE-2026-58048 and CVE-2026-58047 as the story's core claims and referenced CISA enrichment data, a HackerOne CNA record, and a cPanel vendor advisory. The NVD entry for CVE-2026-58048 was fetched directly and confirmed CVSS 9.4, CWE-89, and CISA's 'no exploitation currently observed' assessment. The cPanel vendor advisory portal returned HTTP 403 and could not be verified. Three independent news sources corroborated the technical details and patched builds. A targeted search for public proof-of-concept code found none, confirming an absence of public exploitation tooling as of the report date.

  1. What does the primary source article claim and what requires independent verification?
    Fetched the THN article to extract all stated facts, CVEs, builds, and references
    thehackernews.com ↗

    Confirmed CVE-2026-58048 (CVSS 9.4, CWE-89), CVE-2026-58047 (CVSS 5.6), two Exim GCVEs, specific patched builds, workarounds, researcher credit (Vincent55 Yang via HackerOne), and CISA snapshot of 'no exploitation' as of 4 August 2026

    why Established the complete factual claims and identified the vendor advisory and NVD records as priority verification targets

  2. Is CVE-2026-58048 present in the NVD and does CISA confirm the exploitation status?
    Fetched the NVD detail page for CVE-2026-58048
    nvd.nist.gov ↗

    NVD confirms CVSS 4.0 score 9.4 Critical (AV:N/AC:L/AT:N/PR:L/UI:N), CWE-89, affected products include cPanel & WHM multiple branches and WP Squared below 138.1.6, HackerOne as CNA; CISA SSVC: no exploitation currently observed, not automatable, total technical impact, timestamped 31 July 2026

    why Authoritative primary-source confirmation of all material claims; the July 31 CISA timestamp predating the August 4 article is an unexplained discrepancy recorded as an uncertainty

  3. Can the cPanel vendor advisory be directly verified?
    Attempted WebFetch of the cPanel support advisory URL identified in secondary reporting

    HTTP 403 Forbidden — the support portal blocked direct access; the advisory URL cannot be directly cited as a verified source

    why Excluded the vendor advisory from direct citations; evidential weight shifted to the NVD entry and independently corroborated secondary reporting

  4. Do independent security news sources confirm the technical details and patched builds?
    Fetched hostingdiscussion.com, cybersecuritynews.com, and gbhackers.com coverage of the same release
    hostingdiscussion.com ↗

    All three independently confirmed identical patched build numbers, the SQL-mode-not-preserved root cause, researcher credit, and workarounds; no contradictions found across sources

    why Three independent domains reporting consistent detail against the NVD record provides strong corroboration and satisfies the multi-source requirement

  5. Is any public proof-of-concept or technical exploitation write-up available for CVE-2026-58048?
    Searched for PoC code repositories, HackerOne public disclosures, and researcher write-ups

    No public PoC, exploit code, or independent technical write-up found; HackerOne report is not yet publicly disclosed; generic CVE aggregator repositories do not list this CVE with exploit code

    why Absence of public exploitation tooling reduces immediate risk; confirms poc_refs as empty and supports the CISA 'no exploitation observed' assessment

Named in this story
TargetscPanel & WHM managed serversshared-hosting and multi-tenant hosting environmentsWP Squared deployments
Related CVEs CVE-2026-58048CVE-2026-58047

Research coverage

All 68 registered source leaves were evaluated for this run: 56 completed, 0 were unavailable, 5 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok8 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1660 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok670 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1007 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference failed Failed The current collection attempt failed; this source cannot support the report.
FIRST EPSSepss ok7475 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference failed Failed The current collection attempt failed; this source cannot support the report.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference failed Failed The current collection attempt failed; this source cannot support the report.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference failed Failed The current collection attempt failed; this source cannot support the report.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference failed Failed The current collection attempt failed; this source cannot support the report.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Reporting-linked PoC claims1
https://github.com/cisagov/vulnrichment/blob/develop/2026/58xxx/CVE-2026-58048.json github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

Vendor & gov advisories1
NVD – CVE-2026-58048 Detail nvd.nist.gov ↗

Primary authoritative record confirming CVSS 4.0 score 9.4, CWE-89, CISA SSVC enrichment dated 31 July 2026, and HackerOne as CNA

Analysis & research4
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root – The Hacker News thehackernews.com ↗

Primary analysis covering all three advisories, CISA snapshot, and the vendor/CNA classification discrepancy

cPanel patches a bug that let regular hosting users act as database root – Hosting Discussion hostingdiscussion.com ↗

Independent hosting-sector coverage that corroborates patched builds and locates the vendor advisory URL

Critical cPanel Vulnerability Allows Execution of SQL Commands as Root User – CyberSecurityNews cybersecuritynews.com ↗

Independent corroboration of technical root cause, mitigation steps, and researcher credit

cPanel Database Privilege Escalation Flaw Enables Full Administrative Access – GBHackers gbhackers.com ↗

Further independent corroboration with impact analysis specific to shared-hosting and multi-tenant contexts