Full Report
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries. The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects
Analysis Summary
# Vulnerability: cPanel Database Privilege Escalation via SQL Injection
## CVE Details
- **CVE ID:** CVE-2026-58048
- **CVSS Score:** 9.4 (Critical)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
## Affected Systems
- **Products:** cPanel & WHM, WP Squared
- **Versions:** All supported versions prior to the patched builds listed below.
- **Configurations:** Systems where the "MySQL/MariaDB" feature is enabled for cPanel users.
## Vulnerability Description
The flaw exists within cPanel's database-renaming process. When a user renames a database, the system fails to preserve the "SQL mode," causing subsequent SQL commands to execute within the database's **root context** (administrative identity). This allows an authenticated hosting customer to bypass standard database-level privilege restrictions and execute arbitrary commands with full administrative privileges.
## Exploitation
- **Status:** Not exploited in the wild (as of August 4, 2026).
- **Complexity:** Medium (Requires a valid cPanel account and access to database features).
- **Attack Vector:** Network (Authenticated).
- **Note:** While categorized as non-automatable by CISA, the technical impact is rated as "Total," potentially leading to operating-system-level compromise depending on the database engine configuration.
## Impact
- **Confidentiality:** Total (Full access to all databases on the server).
- **Integrity:** Total (Ability to modify or delete any database data or grants).
- **Availability:** Total (Potential for server-wide disruption or OS-level takeover).
## Remediation
### Patches
Update to the following versions (or higher):
- **cPanel & WHM:** 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32
- **WP Squared:** 138.1.6
**Update Command:**
` /usr/local/cpanel/scripts/upcp --force `
### Workarounds
- **Feature Restriction:** Temporarily revoke the "MySQL" feature from cPanel users via the Feature Manager. This prevents users from renaming or adding databases while leaving existing databases operational.
## Detection
- **Indicators of Compromise:** Unusual administrative SQL commands in database logs (MySQL/MariaDB logs) not originating from root/system administrators, particularly following database rename operations.
- **Detection Methods:** Monitor for cPanel account activities related to `rename_database` actions and audit associated database grant changes.
## References
- **Vendor Advisory:** [https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation]
- **HackerOne/NVD:** [https://nvd.nist.gov/vuln/detail/CVE-2026-58048]
- **CISA Vulnrichment:** [https://github.com/cisagov/vulnrichment/blob/develop/2026/58xxx/CVE-2026-58048.json]
- **cPanel Update Guide:** [https://support.cpanel.net/hc/en-us/articles/1500004959421-How-do-I-update-cPanel-WHM]